CVE-2024-2797

Executive Summary

CVE-2024-2797 is a missing authorization vulnerability in the MailerLite – Signup forms (official) WordPress plugin, affecting all versions up to and including 1.7.6. The plugin fails to perform a capability check on the toggleRolesAndPermissions and editAllowedRolesAndPermissions AJAX actions, allowing unauthenticated attackers to modify plugin settings. Specifically, an attacker can grant lower-level WordPress users (e.g., subscribers) the ability to modify signup forms, leading to potential form defacement, data exfiltration, or phishing attacks. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch is currently available.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or any other web server software. The plugin runs within WordPress and relies on WordPress’s built-in AJAX handler and capability checks, which are missing here.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low integrity impact and no confidentiality or availability impact. However, the ability to modify forms without authentication can lead to phishing or data theft if forms are used to collect sensitive information.

Deep Dive & Mechanics

The vulnerability resides in the toggleRolesAndPermissions and editAllowedRolesAndPermissions functions within the MailerLite plugin. These functions are registered as WordPress AJAX actions for both authenticated and unauthenticated users. The plugin fails to call current_user_can() or any other capability check before processing the request.

• toggleRolesAndPermissions: This function likely toggles whether a specific user role can manage forms. Without a capability check, an unauthenticated attacker can send a POST request to /wp-admin/admin-ajax.php with action=toggleRolesAndPermissions and a role parameter to enable form editing for that role.
• editAllowedRolesAndPermissions: This function likely sets which roles are allowed to modify forms. An attacker can send a request with action=editAllowedRolesAndPermissions and a list of roles to grant form editing permissions to any role, including subscribers.

The attack flow:

1. Attacker sends a crafted HTTP request to the WordPress site.
2. The request includes the AJAX action and parameters.
3. The plugin processes the request without checking if the user has administrative privileges.
4. The attacker can then log in as a low-privileged user (e.g., subscriber) and modify signup forms.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.7.6):

add_action('wp_ajax_toggleRolesAndPermissions', 'toggleRolesAndPermissions');
add_action('wp_ajax_nopriv_toggleRolesAndPermissions', 'toggleRolesAndPermissions');

function toggleRolesAndPermissions() {
    // No capability check
    $role = sanitize_text_field($_POST['role']);
    // Toggle logic...
}

Patched Code (hypothetical):

add_action('wp_ajax_toggleRolesAndPermissions', 'toggleRolesAndPermissions');
// Remove nopriv hook to require authentication
// add_action('wp_ajax_nopriv_toggleRolesAndPermissions', 'toggleRolesAndPermissions');

function toggleRolesAndPermissions() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $role = sanitize_text_field($_POST['role']);
    // Toggle logic...
}

The patch removes the wp_ajax_nopriv_ hook (which allows unauthenticated access) and adds a capability check using current_user_can('manage_options') to ensure only administrators can change permissions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with MailerLite plugin version 1.7.6 or earlier.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action=toggleRolesAndPermissions
   • role=subscriber
   • enable=1 (or similar parameter to enable form editing)
3. Alternatively, send a request to set allowed roles:
   • action=editAllowedRolesAndPermissions
   • roles[]=subscriber
   • roles[]=contributor
4. Verify by logging in as a subscriber and accessing the MailerLite form editor.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=toggleRolesAndPermissions&role=subscriber&enable=1"

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with actions toggleRolesAndPermissions or editAllowedRolesAndPermissions from unauthenticated users.
• Look for unusual patterns in user role changes, especially if low-privileged users suddenly gain form editing capabilities.

Hunting:

• Search WordPress user meta for unexpected mailerlite_allowed_roles entries.
• Review server logs for POST requests to admin-ajax.php with these actions from IPs not associated with known administrators.

Mitigation:

• Immediately update the plugin if a patch becomes available.
• As a workaround, add a custom capability check via a WordPress mu-plugin:

add_action('wp_ajax_toggleRolesAndPermissions', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=toggleRolesAndPermissions or action=editAllowedRolesAndPermissions from unauthenticated sources.
  • Unusual user agent strings or IPs not in the admin whitelist.

• Host IOCs:

  • WordPress user meta entries: wp_usermeta table with meta_key containing mailerlite_allowed_roles for low-privileged users.
  • Plugin file modifications: Check wp-content/plugins/official-mailerlite-sign-up-forms/ for unauthorized changes.

• Log IOCs:

  • Apache/Nginx access logs showing POST /wp-admin/admin-ajax.php with these actions.
  • WordPress debug log entries related to toggleRolesAndPermissions or editAllowedRolesAndPermissions.

Detection Engineering

YARA Rule

rule CVE_2024_2797_MailerLite_Missing_Capability_Check {
    meta:
        description = "Detects vulnerable MailerLite plugin code missing capability checks"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-2797"
    strings:
        $func1 = "toggleRolesAndPermissions"
        $func2 = "editAllowedRolesAndPermissions"
        $nopriv = "wp_ajax_nopriv_"
        $no_cap = "current_user_can"
    condition:
        (($func1 or $func2) and $nopriv) and not $no_cap
}

Sigma Rule

title: MailerLite Plugin Unauthenticated AJAX Actions
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated AJAX requests to toggleRolesAndPermissions or editAllowedRolesAndPermissions
author: Valters IT
date: 2024/03/15
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 
            - 'action=toggleRolesAndPermissions'
            - 'action=editAllowedRolesAndPermissions'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be authenticated)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-2797 MailerLite Unauthenticated AJAX"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=toggleRolesAndPermissions" or content:"action=editAllowedRolesAndPermissions"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block unauthenticated requests to these AJAX actions.
3. Monitor user role changes and audit logs for suspicious activity.

Long-term Fix:

• The vendor must release a patched version that adds capability checks and removes the wp_ajax_nopriv_ hooks for these functions.
• Until then, implement a custom mu-plugin as described in the Blue Team section.

Workaround:

• Add the following rule to .htaccess to block unauthenticated access to these actions:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=(toggleRolesAndPermissions|editAllowedRolesAndPermissions) [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers