CVE-2024-47316

Executive Summary

CVE-2024-47316 is an Authorization Bypass Through User-Controlled Key vulnerability in the Salon Booking System WordPress plugin by Dimitri Grassi. This flaw allows an unauthenticated attacker to manipulate a user-controlled key (likely a booking ID or customer reference) to access or modify booking data belonging to other users. The vulnerability affects all versions up to and including 10.9. With a CVSS score of 4.3 (Medium), the primary impact is on confidentiality, as an attacker can read sensitive booking information without proper authorization. No public exploit code or proof-of-concept has been released, and the vendor has not yet provided a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via automatic updates are affected. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited access to booking data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial-of-service impact.

Threat Level: Medium. The vulnerability is easy to exploit but only exposes limited information (booking details, customer names, dates, services). It does not allow data modification or privilege escalation.

Deep Dive & Mechanics

The vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key. In the Salon Booking System plugin, booking records are likely identified by a numeric or alphanumeric key (e.g., booking_id, reference, or token) passed via GET or POST parameters. The plugin fails to verify that the authenticated user (or session) owns the requested booking. An attacker can enumerate or brute-force these keys to view other customers' bookings.

Root Cause: The plugin does not implement proper access control checks when retrieving booking details. For example, a function like get_booking_by_id($id) may directly query the database without verifying that the current user is the owner of that booking.

Attack Scenario:

1. An attacker identifies a booking detail endpoint, e.g., /wp-admin/admin-ajax.php?action=salon_get_booking&booking_id=123.
2. The attacker changes the booking_id parameter to other values (e.g., 124, 125, etc.).
3. The plugin returns the booking data for those IDs without authentication or authorization checks.
4. The attacker collects sensitive information such as customer names, phone numbers, email addresses, appointment dates, and services booked.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern and the required fix.

Vulnerable Code (Hypothetical):

// In a file like salon-booking-system/includes/class-salon-ajax.php
public function get_booking() {
    $booking_id = intval($_GET['booking_id']);
    $booking = $this->db->get_booking_by_id($booking_id);
    // No ownership check!
    wp_send_json_success($booking);
}

Patched Code (Hypothetical):

public function get_booking() {
    $booking_id = intval($_GET['booking_id']);
    $booking = $this->db->get_booking_by_id($booking_id);
    // Verify ownership
    if ( $booking->customer_id !== get_current_user_id() && ! current_user_can('manage_options') ) {
        wp_send_json_error('Unauthorized');
        return;
    }
    wp_send_json_success($booking);
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Salon Booking System plugin version <= 10.9.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-admin/admin-ajax.php?action=salon_get_booking&booking_id=1
   • /wp-json/salon/v1/booking/1
   • /index.php?salon_action=get_booking&booking_id=1
2. Use a tool like curl or Burp Suite to enumerate booking IDs:

   for i in $(seq 1 1000); do
       curl -s "http://target.com/wp-admin/admin-ajax.php?action=salon_get_booking&booking_id=$i" | jq '.'
   done
   

3. Collect and analyze the returned JSON data for sensitive information.

No public exploit code is available.

Blue Team (Defender)

Detection:

• Monitor for repeated requests to admin-ajax.php with the salon_get_booking action and varying booking_id parameters.
• Look for spikes in 200 responses from the same IP to different booking IDs.
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Search web server logs for patterns like action=salon_get_booking&booking_id= and count distinct IDs per source IP.
• Check for unusual access to booking endpoints from unauthenticated sessions.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=salon_get_booking and sequential booking_id values.
  • User-Agent strings from common enumeration tools (e.g., curl, python-requests, Go-http-client).
• Host:
  • Web server logs showing repeated 200 responses to the same endpoint with different booking IDs.
  • Unusual number of database queries to the bookings table from the web application user.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2024_47316_Salon_Booking_Enumeration {
    meta:
        description = "Detects enumeration attempts against CVE-2024-47316 in Salon Booking System"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47316"
    strings:
        $ajax_action = "action=salon_get_booking"
        $booking_param = "booking_id="
        $wp_admin = "/wp-admin/admin-ajax.php"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-47316 Salon Booking System IDOR Enumeration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential enumeration of booking IDs via the Salon Booking System plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47316
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - "action=salon_get_booking"
            - "booking_id="
    condition: selection
falsepositives:
    - Legitimate use of the booking system by administrators
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47316 Salon Booking System IDOR Enumeration"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=salon_get_booking"; http_uri; content:"booking_id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests with sequential booking_id parameters from the same IP.
3. Restrict access to the vulnerable endpoint via .htaccess or server configuration:

   <IfModule mod_rewrite.c>
       RewriteCond %{QUERY_STRING} action=salon_get_booking [NC]
       RewriteRule ^ - [F,L]
   </IfModule>
   

Long-term Fix:

• The vendor must implement proper authorization checks in all booking-related endpoints. Specifically, ensure that the current user's ID or session token is validated against the booking owner before returning data.
• Apply the principle of least privilege: only allow authenticated users to access their own bookings.

Workaround:

• If the plugin cannot be disabled, consider modifying the plugin code to add ownership checks (as shown in the patched code example). However, this will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers