CVE-2024-13635

Executive Summary

CVE-2024-13635 is a Sensitive Information Exposure vulnerability in the VK Blocks plugin for WordPress, affecting all versions up to and including 1.94.2.2. The flaw resides in the page content block, allowing authenticated attackers with Contributor-level access or higher to extract sensitive data, including the content of private posts and pages. This vulnerability is classified as a WordPress ecosystem issue, as it stems from improper access control within the plugin’s block rendering logic. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public exploit code or patch details are currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of private post/page content)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered medium due to the low privileges required and the potential for sensitive data leakage, though the impact is limited to confidentiality.

Deep Dive & Mechanics

The vulnerability exists in the VK Blocks plugin’s page content block, which is used to embed or display content from other posts/pages. The plugin fails to properly enforce access control checks when rendering this block, allowing authenticated users with Contributor-level access to view content from private or restricted posts/pages. This occurs because the block retrieves and displays content without verifying the user’s permissions for the source post.

The attack vector is network-based, requiring no user interaction. An attacker with a Contributor account can craft a request to the WordPress REST API or directly manipulate the block’s parameters to include content from private posts. The plugin does not sanitize or validate the post ID or permissions before outputting the content.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

function vk_blocks_render_page_content_block($attributes) {
    $post_id = $attributes['postId'];
    $post = get_post($post_id);
    if ($post) {
        return $post->post_content;
    }
    return '';
}

This code lacks a permission check, allowing any authenticated user to retrieve content from any post.

Patched Code (expected fix):

function vk_blocks_render_page_content_block($attributes) {
    $post_id = $attributes['postId'];
    $post = get_post($post_id);
    if ($post && current_user_can('read_post', $post_id)) {
        return $post->post_content;
    }
    return '';
}

The patched version adds a current_user_can('read_post', $post_id) check to ensure the user has permission to read the specific post.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Prerequisites: Authenticated WordPress account with Contributor-level access.
2. Steps:
   • Log in to WordPress as a Contributor.
   • Create or edit a post/page using the VK Blocks plugin.
   • Add a "Page Content" block and set the postId attribute to the ID of a private post (e.g., 123).
   • Save and view the post. The private post’s content will be displayed.
   • Alternatively, use the WordPress REST API to fetch the block’s rendered output:

     curl -X GET "https://target.com/wp-json/wp/v2/posts/123" -H "Cookie: wordpress_logged_in_..."
     

   • If the block is used in a widget or template, the content may be exposed without direct interaction.

Blue Team (Detection & Hardening)

1. Detection:

   • Monitor for unusual access to private posts by Contributor-level users.
   • Look for REST API requests to /wp-json/wp/v2/posts/ with low-privilege cookies.
   • Check for unexpected use of the "Page Content" block in posts/pages edited by Contributors.

2. Hardening:

   • Apply the patch from the plugin vendor when available.
   • Restrict Contributor-level access to sensitive content.
   • Use a Web Application Firewall (WAF) to block requests with suspicious postId parameters.
   • Implement custom code to override the block’s rendering and add permission checks.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-json/wp/v2/posts/ with a postId parameter and a Contributor-level cookie.
  • Unusual access to private post slugs or IDs from low-privilege users.
• File:
  • Log entries showing Contributor users viewing private post content.
  • Modified posts containing the VK Blocks "Page Content" block with non-public post IDs.
• Behavioral:
  • Contributor accounts creating posts that display content from private posts.
  • Increased REST API calls targeting post endpoints from Contributor sessions.

Detection Engineering

YARA Rule

rule CVE_2024_13635_VK_Blocks_Info_Leak {
    meta:
        description = "Detects VK Blocks plugin files vulnerable to CVE-2024-13635"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-13635"
    strings:
        $func = "vk_blocks_render_page_content_block" ascii wide nocase
        $vuln = "get_post(" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        $func and $vuln and not $no_check
}

Sigma Rule

title: CVE-2024-13635 VK Blocks Sensitive Information Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-13635 by accessing private post content via VK Blocks
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/wp-json/wp/v2/posts/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate Contributor access to public posts
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13635 VK Blocks Sensitive Information Exposure"; flow:to_server,established; content:"/wp-json/wp/v2/posts/"; http_uri; nocase; pcre:"/\/wp-json\/wp\/v2\/posts\/\d+/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Disable the VK Blocks plugin until a patch is available.
   • Restrict Contributor-level accounts from editing posts that use the "Page Content" block.
   • Manually audit all posts/pages for the presence of the vulnerable block.

2. Short-term:

   • Apply the vendor patch when released (check https://wordpress.org/plugins/vk-blocks/).
   • Implement a custom filter to override the block’s rendering:

     add_filter('render_block', function($block_content, $block) {
         if ($block['blockName'] === 'vk-blocks/page-content') {
             $post_id = $block['attrs']['postId'];
             if (!current_user_can('read_post', $post_id)) {
                 return '';
             }
         }
         return $block_content;
     }, 10, 2);
     

3. Long-term:

   • Enforce least privilege for all WordPress user roles.
   • Regularly update plugins and core.
   • Use a security plugin (e.g., Wordfence) to monitor for suspicious activity.

Valters IT
DevSecOps & Cyber Threat Intelligence