CVE-2024-6489

Executive Summary

CVE-2024-6489 is a WordPress plugin vulnerability affecting the Getwid – Gutenberg Blocks plugin. The flaw resides in the get_google_api_key function, which lacks a proper capability check. This allows authenticated attackers with at least Contributor-level access to modify the MailChimp API key stored in the WordPress options table. The vulnerability has a CVSS score of 5.3 (Medium) and is currently unpatched. While the EPSS score is 0.0%, the risk is elevated for sites with untrusted Contributor-level users. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Getwid plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. Since the patch status is unknown, administrators must consider manual mitigation steps.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (API key modification)
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for disruption of MailChimp integration. However, the lack of public exploits and low EPSS score reduces immediate urgency.

Deep Dive & Mechanics

The vulnerability exists in the get_google_api_key function within the Getwid plugin. This function is intended to handle API key settings, but it fails to perform a capability check (e.g., current_user_can('manage_options')) before processing the request. As a result, any authenticated user with Contributor-level access or higher can send a crafted POST request to the vulnerable endpoint and modify the MailChimp API key.

The attack flow:

1. An attacker authenticates as a Contributor (or higher) on the WordPress site.
2. The attacker sends a POST request to the vulnerable AJAX action (likely get_google_api_key).
3. The request includes the new MailChimp API key value.
4. The plugin updates the option in the database without verifying the user's capabilities.
5. The legitimate MailChimp integration is disrupted, potentially causing email campaign failures or data exfiltration if the attacker sets a malicious API key.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.0.10):

add_action('wp_ajax_get_google_api_key', 'get_google_api_key_callback');
function get_google_api_key_callback() {
    // Missing capability check
    $api_key = sanitize_text_field($_POST['api_key']);
    update_option('getwid_mailchimp_api_key', $api_key);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_get_google_api_key', 'get_google_api_key_callback');
function get_google_api_key_callback() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $api_key = sanitize_text_field($_POST['api_key']);
    update_option('getwid_mailchimp_api_key', $api_key);
    wp_die();
}

The patch adds a current_user_can('manage_options') check to restrict the function to administrators only.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Getwid plugin <= 2.0.10
• Valid user account with Contributor role or higher
• Network access to the WordPress admin AJAX endpoint

Exploitation Steps:

1. Log in as a Contributor user.
2. Obtain a valid WordPress nonce for the AJAX action (if required).
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action: get_google_api_key
   • api_key: attacker_controlled_mailchimp_key
   • _ajax_nonce: (if required, obtain from page source)

Example cURL command:

curl -X POST https://target-site.com/wp-admin/admin-ajax.php \
  -c cookies.txt \
  -d "action=get_google_api_key&api_key=attacker_mailchimp_key&_ajax_nonce=VALID_NONCE"

Expected Outcome: The MailChimp API key is updated to the attacker's value, disrupting the site's email integration.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=get_google_api_key from non-admin users.
• Alert on changes to the getwid_mailchimp_api_key option in the database.
• Review user role assignments and audit Contributor-level accounts.

Hardening:

• Apply the principle of least privilege: restrict Contributor roles from accessing sensitive AJAX actions.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement a custom plugin or mu-plugin to add capability checks to vulnerable functions.
• Monitor the WordPress plugin repository for an official patch.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/getwid/includes/class-getwid-api.php (or similar file containing the vulnerable function)
• Database Option: getwid_mailchimp_api_key modified unexpectedly
• Log Entry: AJAX request to admin-ajax.php with action=get_google_api_key from a non-admin user
• Network: POST requests to /wp-admin/admin-ajax.php with api_key parameter from low-privilege users

Detection Engineering

YARA Rule

rule CVE_2024_6489_Getwid_Missing_Capability_Check {
    meta:
        description = "Detects vulnerable Getwid plugin code missing capability check"
        author = "Valters IT"
        date = "2024-07-15"
        reference = "CVE-2024-6489"
    strings:
        $vuln_func = "get_google_api_key"
        $ajax_action = "wp_ajax_get_google_api_key"
        $missing_check = "current_user_can" nocase
    condition:
        $vuln_func and $ajax_action and not $missing_check
}

Sigma Rule

title: CVE-2024-6489 - Getwid MailChimp API Key Modification
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized modification of MailChimp API key via Getwid plugin
author: Valters IT
logsource:
    category: application
    product: wordpress
detection:
    selection:
        http.url: "/wp-admin/admin-ajax.php"
        http.method: "POST"
        http.body|contains: "action=get_google_api_key"
        http.body|contains: "api_key="
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6489 - Getwid MailChimp API Key Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_google_api_key"; http_client_body;
    content:"api_key="; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Mitigation:

1. Disable the Getwid plugin until a patch is available.
2. Restrict Contributor roles from accessing AJAX endpoints by adding a custom capability check via a mu-plugin.
3. Monitor and audit the getwid_mailchimp_api_key option for unauthorized changes.

Long-term Remediation:

1. Apply the official patch once released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block AJAX requests to get_google_api_key from non-admin users.
3. Conduct a security review of all WordPress plugins for similar missing capability checks.

Workaround Code (mu-plugin):

<?php
// Prevent unauthorized API key modification
add_action('wp_ajax_get_google_api_key', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 0);

Valters IT
Securing Digital Frontiers