CVE-2024-6631

Executive Summary

CVE-2024-6631 is a Missing Authorization vulnerability in the ImageRecycle pdf & image compression WordPress plugin, affecting all versions up to and including 3.1.14. The plugin fails to perform proper capability checks on several AJAX actions, allowing authenticated attackers with Subscriber-level access or higher to perform unauthorized actions, such as modifying plugin settings. This vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

The CVSS v3.1 base score is 5.0 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The attack complexity is low, requires low privileges, and no user interaction. The impact is limited to integrity (low) with no confidentiality or availability impact.

The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not released a patch, leaving all installations vulnerable.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of the plugin files by checking checksums provided by WordPress.org. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors injecting backdoors via compromised plugin updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs Subscriber-level access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): Low (L) – Limited modification of plugin settings.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the ability to modify plugin settings could lead to further compromise, such as disabling security features or redirecting image processing to malicious servers.

Deep Dive & Mechanics

The vulnerability stems from missing capability checks in AJAX handlers registered by the ImageRecycle plugin. WordPress AJAX actions are typically protected by checking user capabilities (e.g., manage_options for admin actions). In this plugin, several AJAX actions (e.g., wp_ajax_imagerecycle_save_settings, wp_ajax_imagerecycle_reset_settings) lack such checks, allowing any authenticated user, including Subscribers, to call them.

The affected AJAX actions include:

• Saving plugin settings (API keys, compression options)
• Resetting settings to defaults
• Triggering manual compression tasks

An attacker with Subscriber-level access can craft a POST request to /wp-admin/admin-ajax.php with the appropriate action parameter and payload, bypassing authorization.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.1.14):

add_action('wp_ajax_imagerecycle_save_settings', 'imagerecycle_save_settings');
function imagerecycle_save_settings() {
    // No capability check
    update_option('imagerecycle_settings', $_POST['settings']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_imagerecycle_save_settings', 'imagerecycle_save_settings');
function imagerecycle_save_settings() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('imagerecycle_settings', $_POST['settings']);
    wp_die();
}

The fix requires adding current_user_can('manage_options') checks to all AJAX handlers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with ImageRecycle plugin <= 3.1.14
• Valid user account with Subscriber role or higher

Exploitation Steps:

1. Obtain a valid session cookie for a Subscriber user.
2. Craft a POST request to modify plugin settings:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -H "Cookie: wordpress_logged_in_<hash>=<session>" \
  -d "action=imagerecycle_save_settings&settings[api_key]=attacker_key&settings[compression_level]=100"

3. Verify the settings were changed by checking the plugin's settings page or by observing altered behavior.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with actions starting with imagerecycle_ from non-admin users.
2. Review plugin settings for unauthorized changes.
3. Check for unexpected API keys or compression settings.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" action=imagerecycle_*
| eval user_role=if(match(user, "subscriber"), "subscriber", "other")
| where user_role="subscriber"
| table _time, src_ip, user, action, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=imagerecycle_* from low-privilege users.
  • Unusual API keys in plugin settings (e.g., not matching legitimate keys).

• File IOCs:

  • Modified plugin settings in wp_options table with option_name='imagerecycle_settings'.
  • Unexpected changes to plugin files (e.g., wp-content/plugins/imagerecycle-pdf-image-compression/).

• Log IOCs:

  • WordPress debug logs showing AJAX calls from Subscriber users to admin-level actions.

Detection Engineering

YARA Rule

rule CVE_2024_6631_Imagerecycle_Missing_Auth {
    meta:
        description = "Detects missing capability checks in ImageRecycle plugin AJAX handlers"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2024-6631"
    strings:
        $ajax_action = /add_action\s*\(\s*['\"]wp_ajax_imagerecycle_/
        $missing_check = /function imagerecycle_/
        $cap_check = /current_user_can/
    condition:
        $ajax_action and $missing_check and not $cap_check
}

Sigma Rule

title: CVE-2024-6631 - ImageRecycle Plugin AJAX Missing Authorization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized AJAX requests to ImageRecycle plugin actions from low-privilege users
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/wp-admin/admin-ajax.php"
        cs-uri-query|contains: "action=imagerecycle_"
        cs-username|re: "subscriber|contributor|author"
    condition: selection
falsepositives:
    - Legitimate admin actions if user role is misclassified
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6631 - ImageRecycle Plugin AJAX Missing Authorization";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=imagerecycle_";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released by the vendor.
2. Restrict user roles – Remove Subscriber accounts or limit their capabilities using a plugin like "User Role Editor".
3. Web Application Firewall (WAF) rules – Block AJAX requests to imagerecycle_* actions from non-admin users.

Long-term Fix:

• The vendor must release a patched version (e.g., 3.1.15) that adds current_user_can('manage_options') checks to all AJAX handlers.
• Users should update to the latest version once available.

Workaround:

• Add custom code to functions.php to enforce capability checks:

add_action('init', function() {
    if (current_user_can('subscriber')) {
        remove_action('wp_ajax_imagerecycle_save_settings', 'imagerecycle_save_settings');
    }
});

Valters IT
Securing Digital Frontiers