CVE-2024-5770

Executive Summary

CVE-2024-5770 is a medium-severity vulnerability affecting the WP Force SSL & HTTPS SSL Redirect WordPress plugin, versions up to and including 1.66. The issue stems from a missing capability check in the ajax_save_setting function, allowing authenticated attackers with subscriber-level permissions or higher to modify plugin settings without authorization. This can lead to unauthorized changes to SSL redirect configurations, potentially weakening HTTPS enforcement or redirecting traffic to malicious endpoints. The vulnerability is specific to the WordPress ecosystem and does not involve server-level components like Apache or Nginx.

Supply Chain & Package Security

This vulnerability is within the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.2 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation in the wild, but the ease of exploitation (low complexity, low privileges) makes it a viable target for attackers with authenticated access.

Deep Dive & Mechanics

The vulnerability resides in the ajax_save_setting function, which handles AJAX requests to update plugin settings. The function lacks a current_user_can() or similar capability check, meaning any authenticated user—regardless of role—can trigger it. WordPress AJAX actions are typically prefixed with wp_ajax_ for authenticated users, and this function is registered without verifying administrative privileges.

An attacker with subscriber-level access can send a crafted AJAX request to modify settings such as:

• Disabling SSL redirect
• Changing redirect URLs
• Altering HTTPS enforcement rules

This could lead to:

• Man-in-the-Middle (MitM) attacks: If SSL redirect is disabled, users may be served over HTTP.
• Phishing: Redirecting users to attacker-controlled domains.
• SEO manipulation: Changing canonical URLs or redirect patterns.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.66):

add_action('wp_ajax_save_setting', 'ajax_save_setting');
function ajax_save_setting() {
    // No capability check
    $setting = sanitize_text_field($_POST['setting']);
    $value = sanitize_text_field($_POST['value']);
    update_option('wp_force_ssl_' . $setting, $value);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_save_setting', 'ajax_save_setting');
function ajax_save_setting() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $setting = sanitize_text_field($_POST['setting']);
    $value = sanitize_text_field($_POST['value']);
    update_option('wp_force_ssl_' . $setting, $value);
    wp_die();
}

The patch adds a capability check (manage_options) to restrict setting modifications to administrators only.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with WP Force SSL plugin <= 1.66
• Valid subscriber-level credentials (e.g., username: testuser, password: testpass)

Exploitation Steps:

1. Obtain a nonce for the AJAX action (if required) or directly craft the request.
2. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: save_setting
   • setting: redirect_url
   • value: http://attacker-controlled.com

Example cURL command:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=save_setting&setting=redirect_url&value=http://attacker-controlled.com" \
  -c cookies.txt -b cookies.txt

Expected Outcome: The plugin's redirect URL is changed to the attacker's domain, redirecting all HTTP traffic to the malicious site.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=save_setting from non-admin users.
2. Check for unexpected changes to plugin options in the wp_options table (e.g., wp_force_ssl_redirect_url).
3. Review user role assignments and ensure subscriber accounts are not granted elevated privileges.

Honeypot Setup:

• Create a fake subscriber account with limited permissions and monitor its AJAX activity.
• Log all save_setting actions and alert on any modifications.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=save_setting from low-privilege users.
  • Unusual redirect patterns in HTTP responses (e.g., 302 to external domains).
• Host:
  • Modified wp_force_ssl_* options in the WordPress database.
  • Plugin file integrity changes (e.g., modified wp-force-ssl.php).
• Logs:
  • WordPress debug log entries showing AJAX calls from subscriber roles.
  • Web server access logs with admin-ajax.php POST requests from non-admin IPs.

Detection Engineering

YARA Rule

rule CVE_2024_5770_WP_Force_SSL {
    meta:
        description = "Detects vulnerable WP Force SSL plugin versions <= 1.66"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-5770"
    strings:
        $func = "ajax_save_setting" nocase
        $hook = "wp_ajax_save_setting" nocase
    condition:
        $func and $hook
}

Sigma Rule

title: CVE-2024-5770 WP Force SSL Setting Modification
id: 8f4b3e2a-1c7d-4f9b-8e5a-6d3c2b1a0f9e
status: experimental
description: Detects unauthorized modification of WP Force SSL plugin settings via AJAX
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'admin-ajax.php'
        cs-uri-query|contains: 'action=save_setting'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-5770 WP Force SSL Setting Modification Attempt";
    flow:to_server;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=save_setting"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: If a patched version becomes available, update immediately.
2. Disable the plugin: If no patch is available, consider disabling the plugin until a fix is released.
3. Restrict user roles: Ensure subscriber accounts are not granted unnecessary permissions.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block AJAX requests to save_setting from non-admin users.
• Monitor WordPress user activity logs for suspicious AJAX calls.
• Apply the principle of least privilege to all WordPress user roles.

Workaround:

• Add a custom capability check via a WordPress plugin or theme functions.php:

add_action('wp_ajax_save_setting', 'custom_save_setting_check', 1);
function custom_save_setting_check() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}

Valters IT