CVE-2024-1763

Executive Summary

CVE-2024-1763 is a Missing Authorization vulnerability in the Wp Social Login and Register Social Counter WordPress plugin, affecting all versions up to and including 3.0.0. The vulnerability resides in the /wp_social/v1/ REST API endpoint, which lacks a capability check, allowing unauthenticated attackers to enable or disable social share and login providers. This can lead to unauthorized modification of the plugin’s configuration, potentially disrupting user authentication flows or enabling malicious providers.

As a WordPress ecosystem issue, this vulnerability does not affect the underlying web server (Apache/Nginx) but directly impacts the plugin’s REST API implementation. The CVSS score of 6.5 (Medium) reflects the low complexity and network-based attack vector, though the impact is limited to integrity (no data confidentiality or availability loss).

Supply Chain & Package Security

This is a WordPress plugin, not an NPM/PyPI/Go/Ruby package. No supply chain implications beyond the plugin’s update mechanism.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthenticated attackers to modify plugin settings, potentially enabling rogue social login providers or disabling legitimate ones. This could lead to account takeover if a malicious provider is enabled, but the direct impact is limited to configuration changes.

Deep Dive & Mechanics

The vulnerability exists in the /wp_social/v1/ REST API endpoint, which is registered by the plugin to handle provider enable/disable actions. The endpoint does not perform a current_user_can() check or any other authorization verification, meaning any unauthenticated HTTP request to this endpoint can modify the plugin’s provider settings.

Root Cause: The REST API route is registered with permission_callback set to __return_true or omitted entirely, allowing public access. The plugin’s code likely uses register_rest_route() without proper capability validation.

Attack Flow:

1. Attacker identifies a WordPress site running the vulnerable plugin.
2. Attacker sends a POST request to /wp-json/wp_social/v1/provider (or similar) with parameters to enable/disable a provider.
3. The plugin processes the request and updates the database option storing provider configurations.
4. The attacker can enable a malicious OAuth provider (e.g., a fake Facebook app) to harvest user credentials during login.

Impact: Unauthorized modification of social login providers can lead to:

• Disruption of legitimate login flows.
• Phishing attacks via rogue providers.
• Potential account takeover if users authenticate through a malicious provider.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is assumed to be in the REST API registration. A typical vulnerable implementation:

// Vulnerable code (wp-social-login.php or similar)
add_action('rest_api_init', function () {
    register_rest_route('wp_social/v1', '/provider', array(
        'methods' => 'POST',
        'callback' => 'wp_social_update_provider',
        // Missing permission_callback
    ));
});

A patched version would include a capability check:

// Patched code
add_action('rest_api_init', function () {
    register_rest_route('wp_social/v1', '/provider', array(
        'methods' => 'POST',
        'callback' => 'wp_social_update_provider',
        'permission_callback' => function () {
            return current_user_can('manage_options');
        }
    ));
});

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Wp Social Login and Register Social Counter plugin <= 3.0.0.
• Network access to the site.

Exploit Steps:

1. Enumerate the REST API endpoint:

   curl -s https://target.com/wp-json/wp_social/v1/provider
   

2. Send a POST request to enable a provider (e.g., Facebook):

   curl -X POST https://target.com/wp-json/wp_social/v1/provider \
     -H "Content-Type: application/json" \
     -d '{"provider":"facebook","enabled":true}'
   

3. Verify the change by checking the plugin settings page (if accessible) or re-sending a GET request.

Note: No public exploit code exists, but the above demonstrates the simple API call.

Blue Team (Detection & Hardening)

Detection:

• Monitor REST API logs for unauthorized POST requests to /wp-json/wp_social/v1/provider.
• Alert on requests without authentication cookies or tokens.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to /wp-json/wp_social/v1/*.
• Use a security plugin (e.g., Wordfence) to add capability checks to REST endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-json/wp_social/v1/provider from unknown IPs.
  • Unusual provider enable/disable events in plugin logs.
• File IOCs:
  • Modified database entries in wp_options table under wp_social_providers or similar.
• Behavioral IOCs:
  • Sudden appearance of new social login buttons on the login page.
  • Users reporting login failures due to disabled providers.

Detection Engineering

YARA Rule

rule CVE_2024_1763_WP_Social_Login {
    meta:
        description = "Detects vulnerable Wp Social Login plugin REST API endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1763"
    strings:
        $rest_route = "wp_social/v1" nocase
        $permission_missing = "register_rest_route" nocase
    condition:
        $rest_route and $permission_missing
}

Sigma Rule

title: CVE-2024-1763 - Unauthenticated REST API Access to Wp Social Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated POST requests to the vulnerable REST API endpoint
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-json/wp_social/v1/provider'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1763 - Unauthenticated Wp Social Login REST API Access";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-json/wp_social/v1/provider";
    http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2024-1763;
    classtype:attempted-recon;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Add a WAF rule to block unauthenticated requests to /wp-json/wp_social/v1/*.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when available (currently UNKNOWN).
• Implement a custom plugin to add capability checks to the REST endpoint:

  add_filter('rest_pre_dispatch', function ($result, $server, $request) {
      if (strpos($request->get_route(), 'wp_social/v1') !== false) {
          if (!current_user_can('manage_options')) {
              return new WP_Error('rest_forbidden', 'Unauthorized', array('status' => 403));
          }
      }
      return $result;
  }, 10, 3);
  

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.