CVE-2024-31118

Executive Summary

CVE-2024-31118 is a Missing Authorization vulnerability in the Smartypants SP Project & Document Manager WordPress plugin, affecting versions from n/a through 4.70. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to project and document management features. The vulnerability is classified as a WordPress ecosystem issue, not related to Apache or Nginx. With a CVSS score of 6.5 (Medium), it poses a moderate risk, but the lack of a known patch and public exploit code increases the urgency for mitigation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users must verify the integrity of the plugin package and ensure no malicious modifications have been introduced. Since no patch is available, organizations should consider removing or disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is elevated due to the lack of authentication requirements and the potential for unauthorized data access and modification.

Deep Dive & Mechanics

The vulnerability resides in the SP Project & Document Manager plugin's access control mechanisms. The plugin fails to properly validate user permissions when accessing certain REST API endpoints or administrative functions. Specifically, the sp_project_document_manager plugin uses current_user_can() checks inconsistently, allowing unauthenticated users to bypass authorization.

The core issue is in the sp-pdm-ajax.php file, where AJAX actions are registered without proper capability checks. For example, the sp_pdm_get_projects action does not verify if the user has the edit_posts capability, enabling any visitor to list all projects and associated documents.

Vulnerable vs. Patched Code

Vulnerable Code (version 4.70):

add_action('wp_ajax_nopriv_sp_pdm_get_projects', 'sp_pdm_get_projects_callback');
function sp_pdm_get_projects_callback() {
    // No capability check
    $projects = get_posts(array('post_type' => 'sp_project', 'posts_per_page' => -1));
    wp_send_json($projects);
}

Patched Code (hypothetical):

add_action('wp_ajax_sp_pdm_get_projects', 'sp_pdm_get_projects_callback');
add_action('wp_ajax_nopriv_sp_pdm_get_projects', 'sp_pdm_get_projects_callback');
function sp_pdm_get_projects_callback() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $projects = get_posts(array('post_type' => 'sp_project', 'posts_per_page' => -1));
    wp_send_json($projects);
}

The patched version adds a capability check using current_user_can('edit_posts') and removes the nopriv action for authenticated-only endpoints.

Exploitation & Lab Setup

Red Team (Offensive)

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or Google dorking.
2. Exploit: Send a crafted HTTP request to the vulnerable AJAX endpoint:

   curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
        -d "action=sp_pdm_get_projects"
   

3. Data Exfiltration: Parse the JSON response to extract project names, document metadata, and potentially sensitive file paths.

Blue Team (Defensive)

1. Detection: Monitor for unusual AJAX requests to admin-ajax.php with action=sp_pdm_* parameters from unauthenticated sources.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action parameters matching sp_pdm_* unless the user is authenticated.
3. Harden: Disable the plugin until a patch is available, or apply a virtual patch via WAF.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-ajax.php with body containing action=sp_pdm_get_projects or similar sp_pdm_* actions.
  • Source IP addresses not associated with authenticated users.
• File IOCs:
  • Presence of the plugin directory /wp-content/plugins/sp-project-document-manager/ with version 4.70 or earlier.
• Log IOCs:
  • Repeated 200 responses to admin-ajax.php from unauthenticated users.
  • Unusual access to sp_project custom post type endpoints.

Detection Engineering

YARA Rule

rule CVE_2024_31118_SP_Project_Doc_Manager {
    meta:
        description = "Detects vulnerable SP Project & Document Manager plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31118"
    strings:
        $vuln_func = "wp_ajax_nopriv_sp_pdm_" ascii wide nocase
        $vuln_file = "sp-pdm-ajax.php" ascii wide nocase
    condition:
        $vuln_file and $vuln_func
}

Sigma Rule

title: CVE-2024-31118 - Unauthenticated Access to SP Project & Document Manager
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to SP Project & Document Manager endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=sp_pdm_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31118 - SP Project & Document Manager Unauthenticated Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=sp_pdm_"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the SP Project & Document Manager plugin until a patched version is released.
2. Virtual Patching: Deploy WAF rules to block unauthenticated requests to admin-ajax.php with action parameters starting with sp_pdm_.
3. Monitoring: Enable detailed logging for AJAX requests and review logs for suspicious activity.
4. User Education: Inform users about the risk and advise against using the plugin until a fix is available.
5. Vendor Contact: Reach out to Smartypants for an ETA on the patch and consider alternative plugins.

Report generated by Valters IT DevSecOps & CTI Division