CVE-2024-34821

Executive Summary

CVE-2024-34821 is a Missing Authorization vulnerability in the Contact List WordPress plugin (versions <= 2.9.87) developed by Anssi Laitila. This flaw allows unauthenticated attackers to access sensitive data or perform unauthorized actions due to improper access control checks. The vulnerability has a CVSS score of 5.3 (Medium), with a low EPSS probability (0.0%), indicating it is not currently being actively exploited in the wild. No public proof-of-concept (PoC) or exploit code has been released, and no patch is available from the vendor. As a WordPress plugin vulnerability, it affects sites running the Contact List plugin and does not implicate the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Since no patch is available, users must rely on manual mitigation or removal of the plugin. The lack of a patch increases supply chain risk for any site using this plugin, as attackers may target unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the lack of a patch and the potential for unauthorized data access (e.g., contact lists, user data) elevates the risk for affected sites.

Deep Dive & Mechanics

The vulnerability resides in the Contact List plugin’s REST API endpoints or AJAX handlers. The plugin fails to properly enforce authorization checks before executing sensitive operations. Specifically, functions that retrieve or modify contact data do not verify if the requesting user has the necessary permissions (e.g., manage_options or edit_posts). This allows any unauthenticated visitor to:

• Access stored contact lists (names, emails, phone numbers).
• Potentially modify or delete contacts if write operations are also unprotected.
• Enumerate plugin settings or other protected data.

The flaw is classified as CWE-862: Missing Authorization, meaning the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code remains in all versions <= 2.9.87. A typical vulnerable pattern in WordPress plugins is:

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_get_contacts', 'get_contacts_callback');
function get_contacts_callback() {
    $contacts = get_option('contact_list_data');
    wp_send_json($contacts);
}

A patched version would include a capability check:

// Patched: Check user capability
add_action('wp_ajax_get_contacts', 'get_contacts_callback');
add_action('wp_ajax_nopriv_get_contacts', 'get_contacts_callback');
function get_contacts_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $contacts = get_option('contact_list_data');
    wp_send_json($contacts);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Contact List plugin <= 2.9.87.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-json/contact-list/v1/contacts or /wp-admin/admin-ajax.php?action=contact_list_get_data).
2. Send a direct GET request to the endpoint without any authentication headers.
3. If the endpoint returns contact data, the vulnerability is confirmed.

Example cURL command:

curl -v "http://target.com/wp-json/contact-list/v1/contacts"

Expected output: JSON array of contacts (names, emails, phone numbers).

Blue Team

Detection:

• Monitor for unusual access to /wp-json/contact-list/v1/* or admin-ajax.php with actions related to Contact List.
• Look for requests from unauthenticated users (no wordpress_logged_in cookie) to these endpoints.
• Check server logs for 200 responses to these endpoints from unknown IPs.

Hunting:

• Search for contact_list in WordPress options table to identify if the plugin is installed.
• Review recent plugin updates; if version <= 2.9.87, flag as vulnerable.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-json/contact-list/v1/contacts or /wp-admin/admin-ajax.php?action=contact_list_* without authentication cookies.
  • Response bodies containing JSON arrays with fields like name, email, phone.
• File System:
  • Presence of plugin directory /wp-content/plugins/contact-list/ with version file showing <= 2.9.87.
• Logs:
  • Web server access logs showing 200 responses to the above endpoints from IPs not associated with authenticated users.

Detection Engineering

YARA Rule

rule Detect_ContactList_Plugin_Vulnerable {
    meta:
        description = "Detects vulnerable Contact List plugin files (<= 2.9.87)"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-34821"
    strings:
        $version = "Version: 2.9.87" nocase
        $vuln_func = "wp_ajax_nopriv_" nocase
        $no_auth = "current_user_can" nocase
    condition:
        $version and $vuln_func and not $no_auth
}

Sigma Rule

title: Unauthenticated Access to Contact List Plugin Endpoints
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated requests to Contact List plugin REST API or AJAX endpoints.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/wp-json/contact-list/v1/'
            - 'action=contact_list_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated users if cookie is missing in logs
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-34821 - Unauthenticated Contact List Plugin Access";
    flow:to_server,established;
    content:"/wp-json/contact-list/v1/"; http_uri;
    nocase;
    sid:1000001;
    rev:1;
    metadata:created_at 2025-04-10, updated_at 2025-04-10;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the Contact List plugin from the WordPress admin dashboard.
2. Remove plugin files – Delete the /wp-content/plugins/contact-list/ directory to prevent re-activation.
3. Audit for data exposure – Check if contact data was accessed by unauthorized IPs using web server logs.

Long-term Fix:

• Since no patch is available, monitor the plugin’s official page for updates. If the vendor releases a patched version (>= 2.9.88), update immediately.
• Consider replacing the plugin with an alternative that has active security maintenance.

Workaround:

• If the plugin is critical, implement a Web Application Firewall (WAF) rule to block unauthenticated access to /wp-json/contact-list/v1/* and admin-ajax.php?action=contact_list_*.

Valters IT
DevSecOps & Cyber Threat Intelligence