CVE-2024-47362

Executive Summary

CVE-2024-47362 is a Missing Authorization vulnerability in the WordPress plugin Strong Testimonials by WP Chill. This flaw affects all versions up to and including 3.1.16. The vulnerability allows an unauthenticated attacker to perform unauthorized actions due to missing capability checks on certain plugin functions. Given the CVSS score of 4.3 (Medium) and an EPSS score of 0.0%, exploitation is currently not widespread, but the lack of a confirmed patch makes it a persistent risk for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. The absence of a patch from the vendor (WP Chill) means that all installations of Strong Testimonials <= 3.1.16 are potentially affected. Organizations should treat this as a supply chain risk and consider removing or replacing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality Impact (C): None (N) – No data disclosure.
• Integrity Impact (I): Low (L) – Limited ability to modify data.
• Availability Impact (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact. However, the lack of a patch elevates the risk for unmaintained sites.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the Strong Testimonials plugin. The plugin likely exposes AJAX actions or REST API endpoints that perform operations (e.g., creating, updating, or deleting testimonials) without verifying the user's capabilities. An unauthenticated attacker can send crafted HTTP requests to these endpoints to manipulate testimonial data.

Root Cause: The plugin fails to call current_user_can() or similar WordPress capability checks before executing sensitive functions. This is a classic CWE-862 (Missing Authorization) issue.

Attack Vector: An attacker sends a POST request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with a specific action) with malicious parameters. The server processes the request without verifying the user's role.

Impact: The attacker can create fake testimonials, modify existing ones, or delete legitimate entries. This can be used to deface the site, spread misinformation, or damage the site's credibility.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Hypothetical):

add_action('wp_ajax_nopriv_strong_testimonials_create', 'strong_testimonials_create');
function strong_testimonials_create() {
    // No capability check
    $testimonial_data = $_POST['testimonial'];
    // Process and save testimonial
    update_post_meta($post_id, 'testimonial_data', $testimonial_data);
}

Patched Code (Expected):

add_action('wp_ajax_nopriv_strong_testimonials_create', 'strong_testimonials_create');
function strong_testimonials_create() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized', 403);
    }
    $testimonial_data = $_POST['testimonial'];
    // Process and save testimonial
    update_post_meta($post_id, 'testimonial_data', $testimonial_data);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Strong Testimonials <= 3.1.16 installed and active.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable AJAX action. Common actions include strong_testimonials_create, strong_testimonials_update, or strong_testimonials_delete.
2. Send a crafted POST request to /wp-admin/admin-ajax.php:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=strong_testimonials_create&testimonial[author]=Hacker&testimonial[content]=Fake+testimonial"
   

3. Verify the testimonial appears on the site.

Expected Result: A new testimonial is created without authentication.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with actions containing strong_testimonials.
• Look for spikes in testimonial creation from unauthenticated sources.

Response:

• Immediately disable the Strong Testimonials plugin.
• Review and remove any unauthorized testimonials.
• Implement a Web Application Firewall (WAF) rule to block requests to vulnerable endpoints from unauthenticated users.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=strong_testimonials_* parameters.
  • Unusual user agents or IPs making repeated AJAX requests.
• File IOCs:
  • Modified or new testimonial entries in the WordPress database (wp_posts with post_type = 'testimonial').
• Log IOCs:
  • Access logs showing 200 responses to /wp-admin/admin-ajax.php from unauthenticated users.

Detection Engineering

YARA Rule

rule CVE_2024_47362_Strong_Testimonials {
    meta:
        description = "Detects vulnerable Strong Testimonials plugin files"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47362"
    strings:
        $vuln_func = "wp_ajax_nopriv_strong_testimonials" nocase
        $no_check = "current_user_can" nocase
    condition:
        $vuln_func and not $no_check
}

Sigma Rule

title: CVE-2024-47362 - Strong Testimonials Missing Authorization
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts against CVE-2024-47362
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=strong_testimonials_'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47362 - Strong Testimonials Missing Authorization Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=strong_testimonials_"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove or replace Strong Testimonials with an alternative plugin that has proper authorization checks.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• The vendor (WP Chill) must release a patched version that adds current_user_can() checks to all AJAX and REST endpoints.
• Apply the patch as soon as it becomes available.

Workarounds:

• Use a WAF to block unauthenticated requests to /wp-admin/admin-ajax.php with strong_testimonials actions.
• Implement a custom plugin that hooks into the vulnerable actions and adds capability checks.

Valters IT
Securing Digital Frontiers