CVE-2024-24833

Executive Summary

CVE-2024-24833 is a Missing Authorization vulnerability in the Happy Addons for Elementor WordPress plugin, developed by HappyMonster (Leevio). This flaw affects all versions up to and including 3.10.1. The vulnerability allows an unauthenticated attacker to bypass authorization checks, potentially leading to unauthorized access to certain plugin features or data. The CVSS score is 4.3 (Medium), with a low EPSS score of 0.0%, indicating low exploitation activity in the wild. However, due to the widespread use of Elementor and its add-ons, the risk of automated scanning and exploitation remains significant.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. As a third-party add-on for Elementor, it introduces a supply chain risk: users who automatically update or install the plugin without verifying its integrity may be exposed. The lack of a patch from the vendor means that all current installations are vulnerable, and no signed or verified update is available. Organizations should treat this as a high-priority supply chain issue and consider removing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 4.3, the lack of authentication requirements and the plugin’s popularity elevate the risk. Automated scanners can easily identify vulnerable sites.

Deep Dive & Mechanics

The vulnerability stems from improper authorization checks in the plugin’s REST API endpoints or AJAX handlers. The happy-elementor-addons plugin fails to verify user capabilities before executing sensitive actions, such as saving widget settings, importing templates, or modifying plugin options. An unauthenticated attacker can send crafted HTTP requests to trigger these actions.

Root Cause: The plugin uses wp_ajax_* hooks without checking current_user_can() or using nonce verification. This allows any visitor to call privileged functions.

Attack Vector: HTTP POST/GET requests to endpoints like /wp-admin/admin-ajax.php with action parameters such as ha_import_template or ha_save_widget.

Impact: An attacker could:

• Modify widget configurations.
• Import malicious templates.
• Change plugin settings (e.g., enable/disable features).
• Potentially escalate to stored XSS if template import is abused.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.10.1):

add_action('wp_ajax_ha_import_template', 'ha_import_template_callback');
function ha_import_template_callback() {
    // No capability check
    $template = $_POST['template'];
    // Process import...
}

Patched Code (Hypothetical):

add_action('wp_ajax_ha_import_template', 'ha_import_template_callback');
function ha_import_template_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    check_ajax_referer('ha_nonce', 'nonce');
    $template = $_POST['template'];
    // Process import...
}

Key Difference: The patched version adds current_user_can() and nonce verification, ensuring only authenticated users with proper roles can execute the action.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Happy Addons for Elementor <= 3.10.1.
• No authentication required.

Exploit Steps:

1. Identify the target site’s admin-ajax.php URL.
2. Send a POST request with the vulnerable action.

Proof-of-Concept (cURL):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=ha_import_template&template=malicious_template"

Automated Scanning with Nuclei (if template were available):

id: CVE-2024-24833
info:
  name: Happy Addons for Elementor Missing Authorization
  severity: medium
requests:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php"
    body: "action=ha_import_template&template=test"
    matchers:
      - type: word
        words:
          - "success"

Blue Team

Detection:

• Monitor admin-ajax.php requests for unknown actions (e.g., ha_import_template, ha_save_widget).
• Look for POST requests from unauthenticated users to these endpoints.
• Check for unusual template imports or widget changes.

Honeypot:

• Deploy a fake endpoint that logs all requests to ha_* actions.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=ha_* parameters.
  • User-Agent strings from common scanning tools (e.g., Nuclei, curl).
• File System:
  • Unexpected template files in /wp-content/uploads/elementor/templates/.
  • Modified plugin options in wp_options table (e.g., happy_addons_settings).
• Logs:
  • WordPress debug log entries showing unauthorized AJAX calls.
  • Web server access logs with 200 responses to admin-ajax.php from non-logged-in users.

Detection Engineering

YARA Rule

rule CVE_2024_24833_Happy_Addons_Missing_Auth {
    meta:
        description = "Detects vulnerable Happy Addons for Elementor plugin files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-24833"
    strings:
        $vuln_func = "wp_ajax_ha_import_template" nocase
        $vuln_func2 = "wp_ajax_ha_save_widget" nocase
        $no_check = "current_user_can" nocase
    condition:
        any of ($vuln_func*) and not $no_check
}

Sigma Rule

title: CVE-2024-24833 - Happy Addons Missing Authorization
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized AJAX requests to Happy Addons endpoints
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ha_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24833 Happy Addons Missing Authorization"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=ha_"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Block access to admin-ajax.php for unauthenticated users via .htaccess or WAF rules.
3. Monitor logs for suspicious ha_* AJAX requests.

Long-Term Fix:

• The vendor must release a patched version (>= 3.10.2) with proper capability checks and nonce verification.
• Apply the principle of least privilege to all AJAX handlers.

Workaround:

• Add a custom function to your theme’s functions.php to block unauthenticated AJAX calls:

add_action('wp_ajax_nopriv_ha_import_template', function() {
    wp_die('Unauthorized');
}, 1);

Valters IT – Securing your digital frontier.