CVE-2024-3287

Executive Summary

CVE-2024-3287 is a medium-severity vulnerability affecting the SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer plugin (by Wpmudev) in all versions up to and including 3.10.2. The flaw resides in the save_settings function, which lacks a proper capability check, allowing unauthenticated attackers to inject arbitrary ld+json schema markup into the site’s head. This can lead to SEO spam, brand impersonation, or misleading search engine results. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS score of 5.3 (Medium). No public exploit code or proof-of-concept is currently available, and the patch status remains unknown.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The save_settings function is exposed via AJAX actions without verifying user capabilities, enabling unauthenticated manipulation of schema types. Attackers can inject malicious structured data that search engines may parse, potentially harming the site’s SEO reputation or redirecting traffic.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Schema injection possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the impact is limited to integrity, the lack of authentication makes it easy to exploit for SEO manipulation.

Deep Dive & Mechanics

The vulnerability exists in the save_settings function of the SmartCrawl plugin. This function is registered as an AJAX endpoint for both authenticated and unauthenticated users. The code fails to verify the wp_verify_nonce or check user capabilities (e.g., manage_options) before processing the ld+json schema data. An attacker can send a crafted POST request to the AJAX handler with arbitrary JSON-LD content, which is then stored and rendered in the site’s <head> section.

Root Cause: Missing capability check in the save_settings callback. The function directly saves user-supplied schema data without validating the user’s role or nonce.

Attack Flow:

1. Attacker identifies a WordPress site running SmartCrawl <= 3.10.2.
2. Sends a POST request to /wp-admin/admin-ajax.php with action wds-save-settings and malicious ld+json payload.
3. The plugin stores the injected schema in the database.
4. On subsequent page loads, the injected schema is rendered in the HTML head, affecting search engine crawlers.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.10.2):

add_action('wp_ajax_wds-save-settings', 'save_settings');
add_action('wp_ajax_nopriv_wds-save-settings', 'save_settings'); // Missing capability check

function save_settings() {
    // No current_user_can() check
    $schema = $_POST['schema'];
    update_option('wds-schema', $schema);
    wp_send_json_success();
}

Patched Code (Hypothetical):

add_action('wp_ajax_wds-save-settings', 'save_settings');
// Remove nopriv hook to require authentication

function save_settings() {
    if (!current_user_can('manage_options')) {
        wp_send_json_error('Unauthorized');
        return;
    }
    // Validate and sanitize schema
    $schema = sanitize_text_field($_POST['schema']);
    update_option('wds-schema', $schema);
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites: A WordPress site with SmartCrawl plugin <= 3.10.2.

Exploit Steps:

1. Identify the target site’s AJAX URL: https://target.com/wp-admin/admin-ajax.php.
2. Craft a malicious JSON-LD payload (e.g., fake organization schema).
3. Send the following cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wds-save-settings&schema={\"@context\":\"https://schema.org\",\"@type\":\"Organization\",\"name\":\"Malicious Corp\"}"

4. Verify injection by viewing the page source for the injected schema.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action wds-save-settings from unauthenticated users.
• Check for unexpected ld+json blocks in page source.

Hardening:

• Apply the principle of least privilege: ensure only administrators can modify schema settings.
• Use a Web Application Firewall (WAF) to block requests to wds-save-settings from unauthenticated IPs.
• Regularly update the plugin to the latest version.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=wds-save-settings and schema parameter.
• File System: Modified wp_options table entry wds-schema containing unexpected JSON-LD.
• Behavior: Unusual schema markup in page source, such as fake organizations, products, or reviews.

Detection Engineering

YARA Rule

rule CVE_2024_3287_SmartCrawl_Schema_Injection {
    meta:
        description = "Detects malicious schema injection attempts via SmartCrawl plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3287"
    strings:
        $ajax_action = "wds-save-settings"
        $schema_param = "schema="
        $jsonld = /"@context"\s*:\s*"https:\/\/schema\.org"/
    condition:
        $ajax_action and $schema_param and $jsonld
}

Sigma Rule

title: SmartCrawl Unauthenticated Schema Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated POST requests to SmartCrawl's save_settings AJAX action
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=wds-save-settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authenticated)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-3287 SmartCrawl Unauthenticated Schema Injection";
    flow:to_server;
    http.method; content:"POST";
    http.uri; content:"/wp-admin/admin-ajax.php";
    http.client_body; content:"action=wds-save-settings";
    http.client_body; content:"schema=";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version from Wpmudev. If unavailable, disable the plugin until a fix is released.
2. Restrict AJAX Access: Add a capability check to the save_settings function (see patched code above).
3. WAF Rules: Block unauthenticated requests to admin-ajax.php with action=wds-save-settings.

Long-term Measures:

• Implement a Content Security Policy (CSP) to restrict inline scripts.
• Regularly audit WordPress plugins for missing authorization checks.
• Use a security plugin like Wordfence to monitor AJAX actions.

Patch Status: Unknown. Monitor the Wpmudev changelog for updates.

Valters IT