CVE-2024-56294

Executive Summary

CVE-2024-56294 is a Missing Authorization vulnerability in the Nexter Blocks WordPress plugin (also known as the-plus-addons-for-block-editor), developed by POSIMYTH. This flaw allows an unauthenticated attacker to exploit incorrectly configured access control security levels, potentially leading to unauthorized data access or modification. The vulnerability affects all versions up to and including 4.0.7. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating a low probability of active exploitation in the wild, but the risk remains due to the lack of a patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. WordPress plugins are distributed via the official WordPress Plugin Directory or third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. Since no patch is available, the supply chain risk is elevated, as users must rely on vendor responsiveness or implement custom mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability is exploitable without authentication, but the impact is limited to low confidentiality and integrity loss. However, the lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability stems from a Missing Authorization check in the Nexter Blocks plugin. Specifically, certain REST API endpoints or AJAX actions within the plugin fail to verify that the requesting user has the necessary permissions (e.g., edit_posts, manage_options). This allows an unauthenticated attacker to trigger privileged operations.

Root Cause: The plugin likely uses WordPress's wp_ajax_* hooks without a proper current_user_can() check, or it exposes REST API routes without permission_callback validation.

Attack Vector: An attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

POST /wp-admin/admin-ajax.php
action=nexter_blocks_some_action

or

GET /wp-json/nexter-blocks/v1/some-route

Impact: The attacker could:

• Read sensitive plugin settings or user data.
• Modify plugin configurations (e.g., enable/disable features).
• Potentially inject malicious content if the plugin allows data manipulation.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Hypothetical):

add_action('wp_ajax_nopriv_nexter_blocks_action', 'nexter_blocks_handle_action');
function nexter_blocks_handle_action() {
    // Missing permission check
    $data = $_POST['data'];
    update_option('nexter_blocks_setting', $data);
    wp_send_json_success();
}

Patched Code (Expected):

add_action('wp_ajax_nopriv_nexter_blocks_action', 'nexter_blocks_handle_action');
function nexter_blocks_handle_action() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $data = $_POST['data'];
    update_option('nexter_blocks_setting', $data);
    wp_send_json_success();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Nexter Blocks <= 4.0.7 installed and activated.
• Network access to the target.

Steps:

1. Identify vulnerable endpoints by analyzing the plugin's source code or using a fuzzer.
2. Send a crafted request to trigger the missing authorization.

Example Request (Hypothetical):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=nexter_blocks_export_settings" \
  -d "nonce=any_value"

Expected Outcome: The attacker receives sensitive data or modifies settings without authentication.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with action parameters starting with nexter_blocks_.
• Look for REST API requests to /wp-json/nexter-blocks/ from unauthenticated users.

Defense:

• Implement a Web Application Firewall (WAF) rule to block requests to known vulnerable endpoints.
• Disable the plugin until a patch is available.
• Use a security plugin like Wordfence to add virtual patching.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=nexter_blocks_* from unauthenticated sources.
  • REST API calls to /wp-json/nexter-blocks/v1/* without a valid nonce or authentication token.

• File IOCs:

  • Modified plugin files in /wp-content/plugins/the-plus-addons-for-block-editor/.
  • Unexpected entries in the wp_options table with option_name like nexter_blocks_*.

• Log IOCs:

  • WordPress debug log entries showing failed permission checks or unexpected AJAX calls.

Detection Engineering

YARA Rule

rule Detect_Nexter_Blocks_Missing_Auth {
    meta:
        description = "Detects vulnerable Nexter Blocks plugin files with missing authorization"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56294"
    strings:
        $ajax_hook = /add_action\(['\"]wp_ajax_nopriv_nexter_blocks_/
        $rest_route = /register_rest_route\(['\"]nexter-blocks\/v1/
        $missing_check = /current_user_can\(/
    condition:
        ($ajax_hook or $rest_route) and not $missing_check
}

Sigma Rule

title: Unauthenticated Nexter Blocks AJAX Request
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated AJAX requests to Nexter Blocks endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=nexter_blocks_'
    condition: selection
falsepositives:
    - Legitimate admin actions (if authentication is present)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-56294 - Unauthenticated Nexter Blocks AJAX Request";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=nexter_blocks_";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations.
2. Apply virtual patching via a WAF to block requests to admin-ajax.php with action=nexter_blocks_* from unauthenticated users.
3. Monitor logs for exploitation attempts.

Long-Term Fix:

• Wait for the vendor to release a patched version (>= 4.0.8).
• Once available, update the plugin immediately.

Workaround:

• Add the following code to the theme's functions.php to block unauthenticated access to vulnerable endpoints:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX && !is_user_logged_in()) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'nexter_blocks_') === 0) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers