CVE-2024-47328

Executive Summary

CVE-2024-47328 is a critical SQL Injection vulnerability discovered in the FunnelKit Automations WordPress plugin (formerly known as wp-marketing-automations). The flaw resides in the plugin’s failure to properly neutralize special elements used in SQL commands, allowing an unauthenticated attacker to inject arbitrary SQL queries. This can lead to complete database compromise, including extraction of sensitive user data, credential theft, and potential lateral movement within the WordPress ecosystem.

The vulnerability affects all versions of FunnelKit Automations up to and including 3.1.2. As of this report, no official patch has been released by the vendor, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the severity remains high due to the potential impact.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. FunnelKit Automations is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from the vendor and consider disabling the plugin until a patch is available. No known supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands, potentially leading to full database compromise.

Deep Dive & Mechanics

The vulnerability exists in the FunnelKit Automations plugin due to improper sanitization of user-supplied input passed to SQL queries. Specifically, the plugin fails to use prepared statements or parameterized queries when handling certain parameters, allowing an attacker to inject malicious SQL code.

The injection point is likely within the plugin’s automation rule processing or data retrieval functions. By crafting a malicious HTTP request with a specially crafted parameter, an attacker can break out of the intended SQL query structure and execute arbitrary commands.

Example vulnerable code pattern (conceptual):

$id = $_GET['automation_id'];
$query = "SELECT * FROM wp_fka_automations WHERE id = $id";
$result = $wpdb->get_results($query);

Impact:

• Unauthorized access to all WordPress database tables (users, posts, options, etc.)
• Extraction of password hashes, email addresses, and other sensitive data
• Potential privilege escalation to administrator accounts
• Data manipulation or deletion
• Possible server-side request forgery (SSRF) if database functions allow file operations

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Direct concatenation of user input
$automation_id = $_REQUEST['automation_id'];
$sql = "SELECT * FROM {$wpdb->prefix}fka_automations WHERE id = $automation_id";
$results = $wpdb->get_results($sql);

Patched Code (Expected):

// Patched: Use of prepared statement
$automation_id = intval($_REQUEST['automation_id']);
$sql = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}fka_automations WHERE id = %d",
    $automation_id
);
$results = $wpdb->get_results($sql);

Key Differences:

• The patched version uses $wpdb->prepare() with a placeholder (%d) to safely bind the input.
• The vulnerable version directly concatenates the user input into the SQL string.
• The patched version also casts the input to an integer using intval() as an additional safety measure.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with FunnelKit Automations <= 3.1.2 installed and active.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common injection points include parameters like automation_id, rule_id, or action in the plugin’s AJAX handlers.
2. Craft a malicious HTTP request with a SQL injection payload. Example using sqlmap:

   sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=fka_get_automation&automation_id=1" --batch --dbs
   

3. If manual exploitation is preferred, use a simple payload:

   GET /wp-admin/admin-ajax.php?action=fka_get_automation&automation_id=1 UNION SELECT user_login,user_pass FROM wp_users--
   

4. Extract data from the database, focusing on wp_users table for credential hashes.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for unusual SQL-like patterns in request parameters (e.g., UNION, SELECT, OR 1=1).
2. Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts.
3. Use the detection rules provided in the Detection Engineering section.

Mitigation Steps:

1. Immediately disable the FunnelKit Automations plugin if no patch is available.
2. Implement input validation and parameterized queries in any custom code.
3. Apply the principle of least privilege to the database user used by WordPress.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in parameters (e.g., UNION, SELECT, OR, --).
• Requests to /wp-admin/admin-ajax.php with action parameters like fka_get_automation, fka_process_rule, etc.
• Unusually high number of database error messages in server logs.

File IOCs:

• Modified plugin files (check file integrity using checksums).
• Suspicious entries in WordPress options table (e.g., new admin users).

Log IOCs:

• Database error logs showing SQL syntax errors.
• Web server access logs with union select or 1=1 patterns.

Detection Engineering

YARA Rule

rule CVE_2024_47328_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting FunnelKit Automations plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47328"
    strings:
        $s1 = "automation_id" nocase
        $s2 = "rule_id" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "OR 1=1" nocase
        $s6 = "wp_users" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against FunnelKit Automations
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the FunnelKit Automations WordPress plugin (CVE-2024-47328)
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'automation_id='
            - 'rule_id='
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in custom queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47328 SQL Injection Attempt - FunnelKit Automations"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=fka_"; http_uri; pcre:"/(automation_id|rule_id)=.*(UNION|SELECT|OR\s+1=1)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Review database logs for any signs of compromise.

Long-term Actions:

1. Monitor the vendor’s website for an official patch.
2. Apply the patch as soon as it becomes available.
3. Conduct a security audit of all WordPress plugins and themes.
4. Enforce the use of prepared statements in all custom development.

Workaround:

• If the plugin cannot be disabled, restrict access to the vulnerable endpoints using .htaccess rules:

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{QUERY_STRING} (automation_id|rule_id)=.*(UNION|SELECT|OR\s+1=1) [NC]
  RewriteRule ^wp-admin/admin-ajax.php - [F,L]
  </IfModule>
  

Valters IT - This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.