CVE-2024-13776

Executive Summary

CVE-2024-13776 is a high-severity vulnerability (CVSS 8.1) affecting the ZoomSounds - WordPress Wave Audio Player with Playlist plugin, versions up to and including 6.91. The core issue is a Missing Authorization (CWE-862) on the dzsap_delete_notice AJAX action, allowing authenticated attackers with Subscriber-level access or higher to modify arbitrary WordPress options. This can lead to a Denial of Service (DoS) by setting options that cause site errors, or potentially enable features like user registration. The vulnerability is part of a broader pattern of missing capability checks in the plugin.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin’s AJAX handlers lack proper capability checks, a common flaw in WordPress plugins. Attackers exploit this by sending crafted requests to the WordPress admin-ajax.php endpoint.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Can modify options but not arbitrary data.
• Availability (A): High (H) – Can cause site-wide denial of service.

Threat Level: High. While authentication is required, Subscriber accounts are easy to obtain or create on many WordPress sites. The ability to cause a DoS or manipulate critical options makes this a serious risk.

Deep Dive & Mechanics

The vulnerability resides in the dzsap_delete_notice AJAX action, defined in the plugin’s PHP code. The function lacks a current_user_can() or similar capability check, allowing any authenticated user to call it. The action updates a WordPress option (likely dzsap_notice_seen or similar) to the value 'seen'. By manipulating this option, an attacker can:

1. Cause a Denial of Service: Set an option that triggers a fatal error or infinite loop on the site, making it inaccessible.
2. Enable Registration: Set the users_can_register option to true, allowing unauthorized user creation.
3. Other Impacts: The advisory mentions several other functions with missing authorization, potentially allowing broader option manipulation.

The attack is performed via a POST request to /wp-admin/admin-ajax.php with action=dzsap_delete_notice and the required parameters.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern.

Vulnerable Code (zoomsounds/includes/class-ajax.php):

add_action('wp_ajax_dzsap_delete_notice', 'dzsap_delete_notice_callback');
function dzsap_delete_notice_callback() {
    // Missing capability check
    update_option('dzsap_notice_seen', 'seen');
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_dzsap_delete_notice', 'dzsap_delete_notice_callback');
function dzsap_delete_notice_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('dzsap_notice_seen', 'seen');
    wp_die();
}

The fix adds a capability check (manage_options or similar) to restrict access to administrators.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ZoomSounds plugin <= 6.91.
• Valid user credentials with Subscriber role or higher.

Exploit Steps:

1. Obtain a session cookie for the authenticated user.
2. Send a POST request to the WordPress AJAX handler:

curl -X POST \
  -c cookies.txt \
  -b cookies.txt \
  -d "action=dzsap_delete_notice&_ajax_nonce=<nonce_if_required>" \
  https://target.com/wp-admin/admin-ajax.php

3. Verify the option change by checking the site’s behavior (e.g., error messages or registration enabled).

Note: No public exploit code is available, but the attack is trivial to execute.

Blue Team (Detection & Response)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=dzsap_delete_notice from non-admin users.
• Alert on rapid changes to critical WordPress options (e.g., users_can_register, siteurl).

Response:

• Immediately revoke access for any compromised accounts.
• Restore affected options from backups.
• Apply a virtual patch via WAF rules (see Detection Engineering).
• Disable the plugin until an official patch is released.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=dzsap_delete_notice.
  • User-Agent strings from common tools (curl, Python requests).
• Host:
  • WordPress option dzsap_notice_seen set to 'seen' unexpectedly.
  • Unauthorized changes to users_can_register or other options.
• Logs:
  • WordPress debug log entries showing option changes from non-admin users.

Detection Engineering

YARA Rule

rule Detect_ZoomSounds_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-13776 in ZoomSounds plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13776"
    strings:
        $ajax_action = "dzsap_delete_notice"
        $option_update = "update_option"
        $wp_die = "wp_die"
    condition:
        all of them
}

Sigma Rule

title: ZoomSounds CVE-2024-13776 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests targeting the dzsap_delete_notice action
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=dzsap_delete_notice'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13776 ZoomSounds Unauthorized AJAX Action";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=dzsap_delete_notice"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ZoomSounds plugin until a patch is released.
2. Review and harden user roles – Remove unnecessary Subscriber accounts.
3. Implement a Web Application Firewall (WAF) rule to block requests containing action=dzsap_delete_notice from non-admin IPs.

Long-Term Fix:

• The vendor must release a patched version that adds capability checks to all AJAX actions.
• As a workaround, add the following code to the theme’s functions.php to block the vulnerable action:

add_action('wp_ajax_dzsap_delete_notice', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Monitoring:

• Continuously monitor for unauthorized option changes.
• Subscribe to WordPress security advisories for plugin updates.

Valters IT – DevSecOps & Cyber Threat Intelligence