CVE-2024-7351

Executive Summary

CVE-2024-7351 is a critical PHP Object Injection vulnerability discovered in the Simple Job Board plugin for WordPress, affecting all versions up to and including 2.12.3. The flaw resides in the deserialization of untrusted input when editing job applications. An authenticated attacker with Editor-level privileges or higher can inject arbitrary PHP objects. While no known POP (Property Oriented Programming) chain exists within the plugin itself, the presence of a POP chain in another installed plugin or theme could allow the attacker to delete arbitrary files, exfiltrate sensitive data, or achieve remote code execution. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the potential impact is severe. No official patch has been released as of this analysis.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Simple Job Board plugin. It is not related to Apache or Nginx. The risk is amplified by the plugin's reliance on third-party themes and plugins that may introduce exploitable POP chains. Organizations using this plugin should audit their entire WordPress supply chain for potential POP gadgets.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Editor-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While exploitation requires authentication, the potential for full system compromise via a POP chain makes this a critical risk for affected WordPress installations.

Deep Dive & Mechanics

The vulnerability is triggered during the editing of job applications. The plugin uses PHP's unserialize() function on user-supplied input without proper sanitization or validation. When an authenticated Editor modifies a job application, the plugin deserializes the input, allowing an attacker to inject a serialized PHP object.

The core issue is in the edit_job_application function, which processes POST data. The attacker can craft a serialized object that, when deserialized, triggers magic methods like __wakeup() or __destruct() from a POP chain. Since the plugin itself lacks exploitable gadgets, the attacker must rely on other installed components.

Key Code Path (Vulnerable):

// In class-simple-job-board-ajax.php (approximate)
public function edit_job_application() {
    $application_data = $_POST['application_data'];
    $application = unserialize(stripslashes($application_data));
    // ... process $application
}

The stripslashes() call does not mitigate the risk, as it only removes escape characters. The unserialize() function remains dangerous.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.12.3):

$application_data = $_POST['application_data'];
$application = unserialize(stripslashes($application_data));

Patched Code (Hypothetical):

$application_data = $_POST['application_data'];
$application = json_decode(stripslashes($application_data), true);
// Or use a safe deserialization library

The patched version would replace unserialize() with json_decode() or implement strict type checking and validation. Since no official patch exists, users must apply the mitigation steps below.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Simple Job Board <= 2.12.3
• Editor-level credentials
• A POP chain available in another installed plugin/theme (e.g., via __destruct in a logging library)

Exploitation Steps:

1. Identify POP Chain: Scan the WordPress installation for classes with magic methods that perform dangerous actions (e.g., file deletion, code execution).
2. Craft Payload: Create a serialized PHP object that triggers the POP chain. Example using a hypothetical FileDelete class:

   class FileDelete {
       public $file_path = '/etc/passwd';
       public function __destruct() {
           unlink($this->file_path);
       }
   }
   $payload = serialize(new FileDelete());
   echo urlencode($payload);
   

3. Inject Payload: Send a POST request to the vulnerable endpoint with the serialized payload as application_data.

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   Cookie: [editor_cookie]
   
   action=edit_job_application&application_data=O:10:"FileDelete":1:{s:9:"file_path";s:11:"/etc/passwd";}
   

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with action=edit_job_application.
• Look for serialized PHP objects in HTTP parameters (e.g., O:, a:, s: patterns).
• Alert on Editor-level users making unexpected changes to job applications.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block serialized PHP objects.
• Restrict Editor-level access to only trusted users.
• Use a security plugin like Wordfence to monitor for deserialization attempts.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /wp-admin/admin-ajax.php with action=edit_job_application and application_data containing serialized PHP objects (e.g., O:, a:, s:).
• File System: Unexpected file deletions or modifications in WordPress directories.
• Logs: PHP error logs showing unserialize() errors or unexpected class loading.
• Process: Unusual PHP processes executing system commands (if RCE achieved).

Detection Engineering

YARA Rule

rule Detect_Serialized_PHP_Injection {
    meta:
        description = "Detects serialized PHP objects in HTTP requests targeting Simple Job Board"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-7351"
    strings:
        $serialized = /(O:[0-9]+:"|a:[0-9]+:{|s:[0-9]+:")/
        $endpoint = "edit_job_application"
    condition:
        $serialized and $endpoint
}

Sigma Rule

title: CVE-2024-7351 - PHP Object Injection via Simple Job Board
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of PHP Object Injection in Simple Job Board plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=edit_job_application'
        cs-uri-query|re: '(O:[0-9]+:"|a:[0-9]+:{|s:[0-9]+:")'
    condition: selection
falsepositives:
    - Legitimate plugin updates using serialized data (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-7351 - PHP Object Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=edit_job_application"; http_client_body; pcre:"/(O:[0-9]+:\"|a:[0-9]+:\{|s:[0-9]+:\")/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and remove the Simple Job Board plugin until a patch is released.
2. Apply Virtual Patching: Use a WAF to block requests containing serialized PHP objects.
3. Audit Installed Plugins: Remove any plugins or themes that contain POP chains (e.g., those with __destruct or __wakeup methods that perform dangerous actions).

Long-Term Fix:

• Monitor the plugin's official repository for a patched version.
• Replace unserialize() with json_decode() in custom code.
• Implement input validation and sanitization for all user-supplied data.

Workaround:

• Restrict Editor-level access to only highly trusted users.
• Enable logging and monitoring for all admin-ajax.php requests.

Valters IT