CVE-2024-3821

Executive Summary

CVE-2024-3821 is a critical missing authorization vulnerability in the premium version of the wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin for WordPress. The flaw resides in the wdt_ajax_actions.php file, where several AJAX handler functions lack proper capability checks. This allows an unauthenticated attacker to perform unauthorized actions, including manipulating, creating, or deleting data tables and their associated data. The vulnerability affects all versions up to and including 6.3.2. As of this report, no official patch has been released, and no public proof-of-concept exploit code is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is significant due to the potential for data integrity compromise.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress plugin repository and premium marketplaces. Users who have purchased the premium version are at risk. The absence of a patch means that supply chain security relies on the vendor's responsiveness. Administrators should monitor the plugin's update channel and consider disabling the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited information disclosure may be possible.
• Integrity Impact: High (I:H) – An attacker can modify or delete data tables.
• Availability Impact: None (A:N) – No direct denial-of-service impact.

Threat Level: High. The combination of network exploitability, no authentication requirement, and high integrity impact makes this a serious threat for any WordPress site using the premium wpDataTables plugin.

Deep Dive & Mechanics

The vulnerability is located in the wdt_ajax_actions.php file of the wpDataTables plugin. This file registers several AJAX actions for both authenticated and unauthenticated users. The core issue is that the plugin fails to enforce proper capability checks (e.g., current_user_can('manage_options')) on the following AJAX handlers:

• wdt_save_table
• wdt_delete_table
• wdt_duplicate_table
• wdt_get_table
• wdt_save_plugin_settings
• wdt_delete_plugin_settings

These handlers are registered with wp_ajax_ and wp_ajax_nopriv_ prefixes, meaning they are accessible to both authenticated and unauthenticated users. The missing capability check allows any unauthenticated visitor to call these actions and perform operations that should be restricted to administrators.

Attack Flow:

1. An attacker identifies a WordPress site running the vulnerable wpDataTables premium plugin.
2. The attacker sends a crafted POST request to /wp-admin/admin-ajax.php with the action parameter set to one of the vulnerable actions (e.g., wdt_delete_table).
3. The request includes necessary parameters (e.g., table_id for deletion).
4. The server processes the request without verifying the user's permissions, executing the action.
5. The attacker can delete, modify, or duplicate data tables, potentially corrupting the site's data.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (wpDataTables <= 6.3.2):

// wdt_ajax_actions.php
add_action('wp_ajax_wdt_delete_table', 'wdt_delete_table');
add_action('wp_ajax_nopriv_wdt_delete_table', 'wdt_delete_table');

function wdt_delete_table() {
    $table_id = intval($_POST['table_id']);
    // Missing capability check
    // ... deletion logic ...
    wp_die();
}

Patched Code (Hypothetical):

// wdt_ajax_actions.php
add_action('wp_ajax_wdt_delete_table', 'wdt_delete_table');
// Remove the nopriv action to prevent unauthenticated access
// add_action('wp_ajax_nopriv_wdt_delete_table', 'wdt_delete_table');

function wdt_delete_table() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $table_id = intval($_POST['table_id']);
    // ... deletion logic ...
    wp_die();
}

The fix involves removing the wp_ajax_nopriv_ hooks for sensitive actions and adding current_user_can() checks inside each function.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with wpDataTables premium version <= 6.3.2 installed and activated.
• A publicly accessible URL for the target.

Exploitation Steps:

1. Reconnaissance: Identify the target WordPress site and confirm the plugin is active. Look for wpDataTables-related JavaScript or CSS files.
2. Craft the Request: Use curl or a tool like Burp Suite to send a POST request to the AJAX endpoint.

Example: Delete a data table

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wdt_delete_table&table_id=1"

Example: Save/modify a data table

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=wdt_save_table&table_id=1&table_content=malicious_data"

Expected Outcome: The server processes the request and performs the action without authentication, allowing the attacker to manipulate data tables.

Blue Team (Defensive)

Detection:

• Monitor admin-ajax.php requests for unusual action parameters, especially wdt_* actions from unauthenticated users.
• Look for POST requests to /wp-admin/admin-ajax.php with action values like wdt_delete_table, wdt_save_table, etc., originating from IPs not associated with admin users.

Mitigation:

• Immediate: Disable the wpDataTables premium plugin until a patch is available.
• Workaround: Add a custom function to your theme's functions.php to block unauthenticated access to these AJAX actions:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $blocked_actions = array('wdt_save_table', 'wdt_delete_table', 'wdt_duplicate_table', 'wdt_get_table', 'wdt_save_plugin_settings', 'wdt_delete_plugin_settings');
        if (isset($_POST['action']) && in_array($_POST['action'], $blocked_actions)) {
            wp_die('Unauthorized', 403);
        }
    }
});

• Long-term: Apply the vendor's patch when released, or consider replacing the plugin with an alternative.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action parameter containing wdt_ (e.g., wdt_delete_table, wdt_save_table).
  • Requests from IPs not in the site's admin IP whitelist.
• File IOCs:
  • Unexpected modifications to the wpDataTables plugin directory (e.g., /wp-content/plugins/wpdatatables/).
  • New or modified data table entries in the WordPress database (e.g., wp_wpdatatables table).
• Log IOCs:
  • Web server logs showing repeated admin-ajax.php requests with wdt_ actions from the same IP.
  • PHP error logs showing unauthorized access attempts (if custom logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2024_3821_wpDataTables_AJAX_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-3821 in wpDataTables plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3821"
    strings:
        $ajax_action = /action=(wdt_save_table|wdt_delete_table|wdt_duplicate_table|wdt_get_table|wdt_save_plugin_settings|wdt_delete_plugin_settings)/
        $admin_ajax = "admin-ajax.php"
    condition:
        $admin_ajax and $ajax_action
}

Sigma Rule

title: CVE-2024-3821 - wpDataTables Unauthenticated AJAX Actions
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with wpDataTables actions
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: admin-ajax.php
        cs-uri-query|contains|all:
            - 'action=wdt_save_table'
            - 'action=wdt_delete_table'
            - 'action=wdt_duplicate_table'
            - 'action=wdt_get_table'
            - 'action=wdt_save_plugin_settings'
            - 'action=wdt_delete_plugin_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (if logged in)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3821 - wpDataTables Unauthenticated AJAX Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wdt_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the wpDataTables premium plugin if it is not critical to operations. This is the most effective way to eliminate the risk.
2. Vendor Patch: Monitor the plugin's official website or WordPress plugin repository for a security update. Apply the patch as soon as it becomes available.
3. Workaround: Implement the custom functions.php code provided in the Blue Team section to block unauthenticated AJAX actions.
4. Web Application Firewall (WAF): Deploy WAF rules to block POST requests to admin-ajax.php containing action=wdt_ from unauthenticated users.
5. Network Segmentation: If possible, restrict access to the WordPress admin area (/wp-admin/) to trusted IP addresses using .htaccess or firewall rules.
6. Monitoring: Enable detailed logging for admin-ajax.php and review logs regularly for suspicious activity.
7. User Education: Inform site administrators about the vulnerability and the importance of keeping plugins updated.

Valters IT
DevSecOps & Cyber Threat Intelligence Division