CVE-2024-3607

Executive Summary

CVE-2024-3607 is a vulnerability in the PropertyHive WordPress plugin, affecting all versions up to and including 2.0.12. The issue lies in the delete_key_date() function, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary posts without authorization. The vulnerability leads to unauthorized loss of data, impacting the integrity and availability of the WordPress site's content. As a WordPress plugin vulnerability, it is specific to the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The PropertyHive plugin is distributed via the WordPress plugin repository and is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain security considerations are limited to ensuring the plugin is updated from a trusted source and that no malicious forks or tampered versions are used.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) - Subscriber-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L) - Deletion of arbitrary posts

The threat level is medium due to the low privileges required and the potential for data loss. However, the EPSS score of 0.0% suggests low exploitation activity in the wild.

Deep Dive & Mechanics

The vulnerability exists in the delete_key_date() function within the PropertyHive plugin. This function is intended to allow authorized users to delete specific key dates associated with property listings. However, the function does not perform a capability check (e.g., current_user_can('delete_posts')) before executing the deletion. As a result, any authenticated user, including subscribers, can call this function via AJAX or direct request and delete arbitrary posts by providing a valid post ID.

The missing capability check is a classic example of CWE-862 (Missing Authorization). The function likely uses wp_delete_post() or similar, which does not enforce permissions on its own. The attacker only needs to know the post ID and have a valid nonce (if required) to exploit this.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.12):

function delete_key_date() {
    $post_id = intval($_POST['post_id']);
    // No capability check
    wp_delete_post($post_id, true);
    wp_die();
}
add_action('wp_ajax_delete_key_date', 'delete_key_date');

Patched Code (Hypothetical):

function delete_key_date() {
    if (!current_user_can('delete_posts')) {
        wp_die('Unauthorized');
    }
    $post_id = intval($_POST['post_id']);
    wp_delete_post($post_id, true);
    wp_die();
}
add_action('wp_ajax_delete_key_date', 'delete_key_date');

The patch adds a capability check using current_user_can('delete_posts') to ensure only users with the appropriate role (e.g., Editor, Admin) can delete posts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with PropertyHive plugin version <= 2.0.12
• An authenticated user account with subscriber-level access or higher
• A valid nonce (if required by the AJAX handler)

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid nonce for the delete_key_date action (if required). This can be extracted from the page source or by inspecting AJAX requests.
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: delete_key_date
   • post_id: [ID of the post to delete]
   • _ajax_nonce: [valid nonce if required]
4. The post will be deleted without authorization.

Example cURL command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=delete_key_date&post_id=123&_ajax_nonce=abc123' \
  --cookie 'wordpress_logged_in_xxx=...'

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=delete_key_date from low-privilege users.
• Alert on unusual post deletion patterns, especially from subscriber accounts.
• Review logs for wp_delete_post calls triggered by unexpected user roles.

Hunting:

• Search for instances of delete_key_date in web server logs.
• Correlate post deletion events with user roles and IP addresses.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=delete_key_date
  • User-Agent strings from automated tools (e.g., curl, Python requests)
• Host:
  • Unexpected post deletions in the WordPress database
  • Log entries showing wp_delete_post calls from subscriber-level users
• File:
  • Modified or missing post content in the wp_posts table

Detection Engineering

YARA Rule

rule Detect_PropertyHive_Delete_Key_Date_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-3607 in PropertyHive plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-3607"
    strings:
        $ajax_action = "delete_key_date"
        $post_id = "post_id"
    condition:
        $ajax_action and $post_id
}

Sigma Rule

title: PropertyHive Unauthorized Post Deletion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized post deletion via PropertyHive plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=delete_key_date'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"PropertyHive Unauthorized Post Deletion Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=delete_key_date"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update PropertyHive to the latest version immediately.
2. Disable the plugin: If no patch is available, consider disabling the PropertyHive plugin until a fix is released.
3. Restrict user roles: Remove subscriber-level access from untrusted users. Only grant necessary roles.

Long-term Measures:

• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=delete_key_date from non-admin users.
• Regularly audit WordPress plugins for missing capability checks.
• Enforce the principle of least privilege for all WordPress users.

Valters IT
Securing Digital Frontiers