CVE-2024-50422

Executive Summary

CVE-2024-50422 is a Missing Authorization vulnerability in the Cloudways Breeze WordPress caching plugin (versions <= 2.1.14). This flaw allows unauthenticated attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized data exposure or manipulation of cache settings. The vulnerability resides in the WordPress plugin ecosystem and does not affect the underlying web server (Apache/Nginx). With a CVSS score of 5.3 (Medium), the risk is moderate but elevated due to the lack of authentication required for exploitation. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch.

Supply Chain & Package Security

This vulnerability affects the Breeze WordPress plugin, distributed via the official WordPress plugin repository. Users who installed the plugin through the WordPress dashboard or via direct download are impacted. No supply chain compromise has been identified, but the lack of a patch increases the risk of malicious actors weaponizing this flaw.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited impact on confidentiality.

Deep Dive & Mechanics

The Breeze plugin implements caching functionality for WordPress sites. The missing authorization vulnerability occurs in the plugin's REST API endpoints or AJAX handlers that manage cache settings. Specifically, the plugin fails to properly verify user capabilities (e.g., manage_options) before executing sensitive operations such as:

• Clearing the cache
• Modifying cache exclusion rules
• Accessing cached data

An unauthenticated attacker can send crafted HTTP requests to these endpoints, bypassing access controls. The root cause is the absence of current_user_can() checks in the callback functions for these actions.

Affected Components:

• wp-json/breeze/v1/* REST API endpoints
• AJAX actions registered via wp_ajax_* hooks (without wp_ajax_nopriv_* counterparts)

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.1.14):

add_action('wp_ajax_breeze_purge_cache', 'breeze_purge_cache_callback');
function breeze_purge_cache_callback() {
    // No capability check
    // Execute cache purge
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_breeze_purge_cache', 'breeze_purge_cache_callback');
function breeze_purge_cache_callback() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // Execute cache purge
    wp_die();
}

The patch adds a capability check (manage_options) to ensure only administrators can trigger sensitive actions.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Breeze plugin <= 2.1.14
• Network access to the target

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=breeze_purge_cache).
2. Send an unauthenticated POST request:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=breeze_purge_cache"

3. Observe cache purge without authentication.

Note: No public exploit code exists; this is a theoretical demonstration.

Blue Team

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=breeze_* parameters from unauthenticated sources.
• Alert on repeated cache purge actions without corresponding login events.

Hunting:

• Search logs for breeze_purge_cache or breeze_clear_cache in admin-ajax.php requests.
• Correlate with IP addresses that have no prior authentication.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=breeze_purge_cache or similar.
  • Requests to /wp-json/breeze/v1/* endpoints without authentication tokens.
• File System:
  • Unexpected cache directory deletions (e.g., /wp-content/cache/breeze/).
• Logs:
  • Repeated 200 responses to unauthenticated AJAX requests.

Detection Engineering

YARA Rule

rule CVE_2024_50422_Breeze_Missing_Auth {
    meta:
        description = "Detects vulnerable Breeze plugin code with missing authorization"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2024-50422"
    strings:
        $func1 = "breeze_purge_cache_callback" ascii wide nocase
        $func2 = "breeze_clear_cache" ascii wide nocase
        $no_check = "current_user_can" ascii wide nocase
    condition:
        ($func1 or $func2) and not $no_check
}

Sigma Rule

title: CVE-2024-50422 Breeze Missing Authorization Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to Breeze plugin AJAX endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=breeze_'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin actions (requires correlation with authentication)
level: medium

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-50422 Breeze Missing Authorization Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=breeze_"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Breeze plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to admin-ajax.php with action=breeze_* parameters.
3. Restrict access to /wp-admin/ directory via .htaccess or IP whitelisting.

Long-term Fix:

• Monitor the vendor's repository for a patched version (>= 2.1.15).
• Apply the patch manually by adding current_user_can('manage_options') checks to all AJAX and REST callbacks.

Workaround:

• Use a security plugin (e.g., Wordfence) to add capability checks to vulnerable endpoints.

Valters IT