CVE-2024-2043

Executive Summary

CVE-2024-2043 is a Missing Authorization vulnerability in the EleForms – All In One Form Integration including DB for Elementor WordPress plugin. This flaw allows unauthenticated attackers to download form submissions, leading to unauthorized data access. The vulnerability affects all versions up to and including 2.9.9.7. The CVSS score is 5.3 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or Nuclei template is available at this time.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The EleForms plugin stores form submissions in the WordPress database and provides a download feature for administrators. The missing capability check on the download endpoint allows any unauthenticated user to retrieve these submissions, potentially exposing sensitive user data.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no authentication requirement, but the impact is limited to data exposure (confidentiality) without affecting integrity or availability.

Deep Dive & Mechanics

The vulnerability resides in the form submission download functionality of the EleForms plugin. The plugin registers an AJAX action or direct endpoint to download form submissions as CSV or other formats. The code fails to perform a capability check (e.g., current_user_can('manage_options')) before processing the download request. This allows any unauthenticated user to call the endpoint and retrieve all stored form submissions.

The missing capability check is a classic CWE-862: Missing Authorization. The plugin likely uses a function like wp_ajax_nopriv_* or a direct REST API endpoint without verifying user permissions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.9.9.7):

add_action('wp_ajax_nopriv_eleforms_download_submissions', 'eleforms_download_submissions');
function eleforms_download_submissions() {
    // No capability check
    $form_id = $_GET['form_id'];
    $submissions = get_form_submissions($form_id);
    // Output CSV
    header('Content-Type: text/csv');
    // ... output data
    exit;
}

Patched Code (Hypothetical):

add_action('wp_ajax_eleforms_download_submissions', 'eleforms_download_submissions');
function eleforms_download_submissions() {
    // Capability check added
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $form_id = $_GET['form_id'];
    $submissions = get_form_submissions($form_id);
    // Output CSV
    header('Content-Type: text/csv');
    // ... output data
    exit;
}

The patch removes the nopriv hook (which allows unauthenticated access) and adds a capability check.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Identify Target: Scan for WordPress sites using the EleForms plugin (e.g., via Shodan dorks or WPScan).
2. Enumerate Endpoint: The vulnerable endpoint is typically /wp-admin/admin-ajax.php?action=eleforms_download_submissions&form_id=1.
3. Exploit: Send a GET request without authentication:

   curl "http://target.com/wp-admin/admin-ajax.php?action=eleforms_download_submissions&form_id=1"
   

4. Extract Data: The response will contain form submissions in CSV format. Iterate through form IDs to dump all data.

Blue Team (Detection & Defense)

1. Monitor Logs: Look for requests to /wp-admin/admin-ajax.php with action=eleforms_download_submissions from unauthenticated IPs.
2. Network Detection: Use Suricata rules to alert on such requests.
3. Harden: Disable the plugin or apply a virtual patch via WAF (e.g., block admin-ajax.php?action=eleforms_download_submissions for unauthenticated users).
4. Audit: Check for unauthorized access in server logs and review form submission data for exposure.

Indicators of Compromise (IOCs)

• URL Pattern: /wp-admin/admin-ajax.php?action=eleforms_download_submissions&form_id=*
• HTTP Request: GET request to the above URL without authentication cookies.
• Response: CSV file containing form submission data.
• Log Entry: "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 with action=eleforms_download_submissions in the request body or query string.

Detection Engineering

YARA Rule

rule CVE_2024_2043_EleForms_Download {
    meta:
        description = "Detects exploitation attempts for CVE-2024-2043 in EleForms plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2043"
    strings:
        $action = "eleforms_download_submissions"
        $ajax = "admin-ajax.php"
    condition:
        $action and $ajax
}

Sigma Rule

title: CVE-2024-2043 EleForms Unauthenticated Data Download
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthenticated requests to download form submissions via EleForms plugin
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2043
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=eleforms_download_submissions'
    condition: selection
falsepositives:
    - Legitimate admin requests (if authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2043 EleForms Unauthenticated Data Download Attempt"; flow:to_server; content:"GET"; http_method; content:"admin-ajax.php"; http_uri; content:"action=eleforms_download_submissions"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the EleForms plugin until a patch is available.
2. Virtual Patching: Use a Web Application Firewall (WAF) to block requests to /wp-admin/admin-ajax.php with action=eleforms_download_submissions from unauthenticated users.
3. Update: Monitor the plugin vendor for a patched version (expected to be > 2.9.9.7) and apply it promptly.
4. Audit: Review server logs for any unauthorized access to form submissions and notify affected users if data was exposed.
5. Long-term: Implement capability checks in all custom WordPress plugins and follow the principle of least privilege.

Valters IT
DevSecOps & Cyber Threat Intelligence