CVE-2024-13601

Executive Summary

CVE-2024-13601 is an Insecure Direct Object Reference (IDOR) vulnerability in the Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. The flaw exists in the exportusereraserequest function, which fails to validate a user-controlled key, allowing authenticated attackers with Subscriber-level access or higher to export ticket data belonging to any user. This vulnerability affects all versions up to and including 1.0.5. The CVSS score is 4.3 (Medium), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for targeted attacks.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and may be installed automatically or manually. Users should verify the integrity of the plugin file (majestic-support.php) and ensure no unauthorized modifications have been made. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Subscriber-level access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited data exposure (ticket data).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability allows unauthorized data access but requires authentication and does not lead to full system compromise.

Deep Dive & Mechanics

The vulnerability resides in the exportusereraserequest function within the Majestic Support plugin. This function is intended to export ticket data for a specific user when a data erasure request is processed. However, the function uses a user-supplied key (likely a user ID or ticket ID) without proper authorization checks. An authenticated attacker can manipulate this key to request ticket data for any other user, bypassing access controls.

Root Cause: Missing validation on the user-controlled key parameter. The plugin does not verify that the authenticated user has permission to access the requested user's ticket data.

Attack Flow:

1. Attacker authenticates with Subscriber-level credentials.
2. Attacker crafts a request to the exportusereraserequest endpoint, modifying the key parameter to target another user.
3. The plugin processes the request and returns the ticket data for the targeted user.
4. Attacker exfiltrates the data.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.5):

function exportusereraserequest() {
    $user_id = $_GET['user_id']; // No validation
    $tickets = get_tickets_by_user($user_id);
    export_csv($tickets);
}

Patched Code (hypothetical fix):

function exportusereraserequest() {
    $current_user_id = get_current_user_id();
    $requested_user_id = intval($_GET['user_id']);
    if ($current_user_id !== $requested_user_id && !current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $tickets = get_tickets_by_user($requested_user_id);
    export_csv($tickets);
}

The patch adds a check to ensure the requesting user is either the owner of the data or an administrator.

Exploitation & Lab Setup

Red Team

1. Prerequisites: WordPress instance with Majestic Support plugin <= 1.0.5, a Subscriber-level account.
2. Steps:
   • Log in as a Subscriber.
   • Identify the vulnerable endpoint: /wp-admin/admin-ajax.php?action=exportusereraserequest&user_id=TARGET_USER_ID
   • Replace TARGET_USER_ID with the ID of another user (e.g., an admin).
   • Send the request and capture the CSV output containing ticket data.
3. Example cURL:

   curl -c cookies.txt -b cookies.txt "http://target/wp-admin/admin-ajax.php?action=exportusereraserequest&user_id=2"
   

Blue Team

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with the action=exportusereraserequest parameter.
2. Log Analysis: Check WordPress logs for requests where user_id differs from the authenticated user's ID.
3. Mitigation: Apply the hypothetical patch or disable the plugin until an official fix is released.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin-ajax.php with action=exportusereraserequest and a user_id parameter.
• Logs: WordPress debug logs showing unauthorized access attempts to the exportusereraserequest function.
• File: CSV files exported from the plugin containing ticket data for users other than the requester.

Detection Engineering

YARA Rule

rule Detect_Majestic_Support_IDOR_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13601 in Majestic Support plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13601"
    strings:
        $ajax_action = "exportusereraserequest"
        $user_id_param = "user_id="
    condition:
        $ajax_action and $user_id_param
}

Sigma Rule

title: Majestic Support IDOR Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-13601 via AJAX requests
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=exportusereraserequest'
    condition: selection
falsepositives:
    - Legitimate admin use (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13601 Majestic Support IDOR Exploit";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=exportusereraserequest";
    http_uri;
    content:"user_id=";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Disable the Majestic Support plugin until an official patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=exportusereraserequest from non-admin users.
3. Long-term: Apply the hypothetical patch provided above or update to a patched version when available.
4. Monitoring: Enable detailed logging for AJAX requests and review logs for suspicious activity.
5. User Education: Advise users with Subscriber-level access to report any unusual behavior.

Valters IT – DevSecOps & Cyber Threat Intelligence