CVE-2024-1870

Executive Summary

CVE-2024-1870 is a medium-severity vulnerability affecting the Colibri Page Builder plugin for WordPress, up to and including version 1.0.260. The flaw resides in the callActivateLicenseEndpoint function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access or higher to modify the plugin’s license key without authorization. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS score of 4.3. No public exploit code or patch is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The Colibri Page Builder plugin is distributed via the WordPress plugin repository and directly installed on WordPress sites. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress installations using the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated subscriber access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized modification of license key
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privilege users. The impact is limited to integrity of the license key, which could lead to service disruption or unauthorized feature access.

Deep Dive & Mechanics

The vulnerability exists in the callActivateLicenseEndpoint function within the Colibri Page Builder plugin. This function is intended to handle license activation requests. However, it fails to perform a capability check (e.g., current_user_can('manage_options')) before processing the request. As a result, any authenticated user with subscriber-level access or higher can send a crafted HTTP request to the endpoint and modify the license key stored in the WordPress options table.

The attack flow:

1. An attacker authenticates as a subscriber (or higher role) on the target WordPress site.
2. The attacker sends a POST request to the vulnerable endpoint (likely /wp-admin/admin-ajax.php with an action parameter) containing a new license key.
3. The callActivateLicenseEndpoint function processes the request without verifying the user’s capabilities.
4. The license key is updated in the database, potentially causing the plugin to malfunction or enabling unauthorized premium features.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.0.260):

function callActivateLicenseEndpoint() {
    // No capability check
    $license_key = sanitize_text_field($_POST['license_key']);
    update_option('colibri_license_key', $license_key);
    // ... rest of activation logic
}
add_action('wp_ajax_colibri_activate_license', 'callActivateLicenseEndpoint');

Patched Code (Hypothetical):

function callActivateLicenseEndpoint() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $license_key = sanitize_text_field($_POST['license_key']);
    update_option('colibri_license_key', $license_key);
    // ... rest of activation logic
}
add_action('wp_ajax_colibri_activate_license', 'callActivateLicenseEndpoint');

The patch adds a current_user_can('manage_options') check to ensure only administrators can modify the license key.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Colibri Page Builder <= 1.0.260
• Valid subscriber account credentials

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a nonce if required (check plugin source).
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: colibri_activate_license
   • license_key: ATTACKER_CONTROLLED_KEY
4. The license key is updated.

Example cURL Command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=colibri_activate_license&license_key=EVIL_LICENSE_KEY" \
  --cookie "wordpress_logged_in_xxx=..."

Blue Team

Detection:

• Monitor for unauthorized license key changes via WordPress audit logs.
• Look for update_option('colibri_license_key', ...) calls from non-admin users.
• Alert on wp_ajax_colibri_activate_license requests from low-privilege users.

Hunting:

• Query database for recent changes to colibri_license_key option.
• Review HTTP logs for POST requests to /wp-admin/admin-ajax.php with action=colibri_activate_license from non-admin IPs.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/colibri-page-builder/... (any file containing callActivateLicenseEndpoint)
• Database Option: colibri_license_key modified unexpectedly
• HTTP Request: POST to /wp-admin/admin-ajax.php with action=colibri_activate_license from subscriber-level user
• Log Entry: update_option('colibri_license_key', ...) in WordPress debug log

Detection Engineering

YARA Rule

rule CVE_2024_1870_Colibri_License_Key_Modification {
    meta:
        description = "Detects vulnerable Colibri Page Builder plugin code missing capability check"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1870"
    strings:
        $func = "callActivateLicenseEndpoint"
        $no_check = "update_option('colibri_license_key'"
        $ajax = "wp_ajax_colibri_activate_license"
    condition:
        $func and $no_check and not $ajax
}

Sigma Rule

title: CVE-2024-1870 Colibri License Key Modification
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized modification of Colibri license key by low-privilege users
author: Valters IT
date: 2024-01-01
logsource:
    category: application
    product: wordpress
detection:
    selection:
        action: "colibri_activate_license"
        user_role: "subscriber"
    condition: selection
falsepositives:
    - Legitimate admin actions (if admin uses subscriber account)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-1870 Colibri License Key Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=colibri_activate_license"; http_client_body;
    content:"license_key="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: If a patched version becomes available, update Colibri Page Builder immediately.
2. Disable Plugin: Temporarily deactivate the plugin if no patch is available.
3. Restrict User Roles: Ensure only trusted administrators have subscriber-level access or higher.

Long-term Fix:

• Apply the patch by adding a capability check (current_user_can('manage_options')) to the callActivateLicenseEndpoint function.
• Implement proper nonce verification for all AJAX actions.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=colibri_activate_license from non-admin users.
• Monitor and audit all license key changes.

Valters IT