CVE-2024-1452

Executive Summary

CVE-2024-1452 is a vulnerability in the GenerateBlocks plugin for WordPress, affecting all versions up to and including 1.8.2. The flaw resides in the Query Loop block functionality, which fails to properly enforce access controls on post status. This allows authenticated attackers with at least Contributor-level access to view the contents of posts and pages that are in draft, private, or scheduled status. The vulnerability is classified as a Sensitive Information Exposure (CWE-200) with a CVSS score of 4.3 (Medium). No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not yet provided a patch. This issue is specific to the WordPress ecosystem and does not involve Apache or Nginx.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker must have Contributor-level access or higher.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited exposure of sensitive post content.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authentication and is limited to information disclosure, but it can expose sensitive draft or private content.

Deep Dive & Mechanics

The GenerateBlocks plugin extends the WordPress block editor with custom blocks, including a Query Loop block that allows site builders to display lists of posts based on various criteria. The vulnerability arises because the Query Loop block does not properly check the post status when rendering results for authenticated users. Specifically, when a user with Contributor-level access or higher uses the Query Loop block, the plugin fails to filter out posts that are in draft, private, or scheduled status. This means that an attacker can craft a request to the Query Loop endpoint and retrieve the content of these restricted posts.

The issue is rooted in the plugin's REST API or AJAX handler that processes Query Loop requests. The code likely uses WP_Query without explicitly setting the post_status parameter to only include published posts, or it incorrectly trusts the user's capabilities to view private posts. In WordPress, the read_private_posts capability is required to view private posts, but Contributors do not have this capability by default. The plugin's oversight allows the bypass of this capability check.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code remains in all versions up to 1.8.2. The following is a hypothetical example of the vulnerable code and a potential fix.

Vulnerable Code (PHP):

// In generateblocks/includes/class-query-loop.php
public function get_query_results( $attributes ) {
    $query_args = array(
        'post_type'      => $attributes['postType'],
        'posts_per_page' => $attributes['postsPerPage'],
        // Missing post_status filter
    );
    $query = new WP_Query( $query_args );
    return $query->posts;
}

Patched Code (Hypothetical):

// In generateblocks/includes/class-query-loop.php
public function get_query_results( $attributes ) {
    $query_args = array(
        'post_type'      => $attributes['postType'],
        'posts_per_page' => $attributes['postsPerPage'],
        'post_status'    => 'publish', // Only show published posts
    );
    // Additionally, check user capabilities for private posts
    if ( current_user_can( 'read_private_posts' ) ) {
        $query_args['post_status'] = array( 'publish', 'private' );
    }
    $query = new WP_Query( $query_args );
    return $query->posts;
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Obtain a valid WordPress account with Contributor-level access or higher on a site using GenerateBlocks <= 1.8.2.
2. Craft Request: Send a POST request to the WordPress REST API endpoint that handles Query Loop requests (e.g., /wp-json/generateblocks/v1/query). Include a payload that requests posts without specifying a post_status filter.
3. Example Request:

   POST /wp-json/generateblocks/v1/query HTTP/1.1
   Host: target-site.com
   Content-Type: application/json
   Cookie: wordpress_logged_in_<hash>=<session>
   
   {
       "postType": "post",
       "postsPerPage": 10
   }
   

4. Response: The response will include posts in draft, private, and scheduled status, exposing their titles, content, and metadata.

Blue Team

1. Monitor Logs: Look for unusual REST API requests to /wp-json/generateblocks/v1/query from authenticated users with Contributor or Author roles.
2. Audit User Activity: Check for users with low privileges (Contributor, Author) making excessive API calls or viewing posts they should not have access to.
3. Harden Permissions: Temporarily restrict the generateblocks/v1/query endpoint to only users with Editor or Administrator roles using a custom plugin or .htaccess rule.
4. Example Apache Rule:

   <IfModule mod_rewrite.c>
   RewriteEngine On
   RewriteCond %{REQUEST_URI} ^/wp-json/generateblocks/v1/query [NC]
   RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_<admin_hash> [NC]
   RewriteRule .* - [F,L]
   </IfModule>
   

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/generateblocks/v1/query with JSON payloads lacking post_status parameter.
• Logs: WordPress debug log entries showing WP_Query results containing non-published posts for low-privilege users.
• File: Presence of GenerateBlocks plugin version 1.8.2 or earlier in /wp-content/plugins/generateblocks/.

Detection Engineering

YARA Rule

rule CVE_2024_1452_GenerateBlocks_InfoDisclosure {
    meta:
        description = "Detects vulnerable GenerateBlocks plugin files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1452"
    strings:
        $vuln_func = "get_query_results" ascii wide nocase
        $missing_status = "post_status" ascii wide nocase
    condition:
        $vuln_func and not $missing_status
}

Sigma Rule

title: CVE-2024-1452 - GenerateBlocks Query Loop Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-1452 via REST API
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-json/generateblocks/v1/query
        cs-uri-query: '*'
    condition: selection
falsepositives:
    - Legitimate use by Editors/Administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1452 - GenerateBlocks Query Loop Info Disclosure"; flow:to_server; content:"POST"; http_method; content:"/wp-json/generateblocks/v1/query"; http_uri; content:"postType"; http_client_body; content:"postsPerPage"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the GenerateBlocks plugin until a patch is released.
2. Workaround: Use a WordPress security plugin (e.g., Wordfence) to block REST API access to the Query Loop endpoint for non-Administrator roles.
3. Long-term: Monitor the GenerateBlocks plugin page for updates and apply the patch as soon as it becomes available.
4. User Management: Review user roles and remove unnecessary Contributor/Author accounts.

Valters IT
Securing Digital Frontiers