CVE-2024-7573

Executive Summary

CVE-2024-7573 is a critical argument injection vulnerability in the Relevanssi Live Ajax Search WordPress plugin, affecting all versions up to and including 2.4. The flaw resides in the search function, which fails to properly validate user-supplied POST data. This allows an unauthenticated attacker to inject arbitrary arguments into a WP_Query object, potentially exposing sensitive information such as private posts, attachments, or other non-public content. The vulnerability has a CVSS score of 5.3 (Medium), but its impact is amplified by the lack of authentication required and the potential for data leakage. As of this report, no official patch has been released, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems. The lack of a patch from the vendor (Relevanssi) means that users must rely on alternative mitigations, such as disabling the plugin or implementing a Web Application Firewall (WAF) rule.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (information disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the vulnerability does not allow for code execution or data modification, it can lead to the exposure of sensitive information, which could be leveraged for further attacks.

Deep Dive & Mechanics

The vulnerability exists in the search function of the Relevanssi Live Ajax Search plugin. The plugin handles AJAX requests for live search functionality. The search function processes POST data and uses it to construct a WP_Query object. Due to insufficient validation, an attacker can inject arbitrary arguments into the query.

Technical Details:

• The plugin receives POST data, including a search parameter.
• This data is passed to the WP_Query constructor without proper sanitization.
• An attacker can craft a POST request with additional query arguments, such as post_type, post_status, or s, to manipulate the query.
• For example, an attacker could inject post_type=any and post_status=publish,private to retrieve private posts.
• The results are then returned in the AJAX response, exposing sensitive data.

Root Cause: The plugin uses new WP_Query( $args ) where $args is partially derived from user input. The $args array is not filtered to remove dangerous keys like post_type, post_status, or meta_query.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.4):

function search() {
    $args = array(
        's' => $_POST['search'],
        'posts_per_page' => 10,
    );
    // No validation of additional POST parameters
    $query = new WP_Query( $args );
    // ... rest of the function
}

Patched Code (hypothetical):

function search() {
    $allowed_args = array( 's', 'posts_per_page', 'post_type' );
    $args = array();
    foreach ( $allowed_args as $key ) {
        if ( isset( $_POST[ $key ] ) ) {
            $args[ $key ] = sanitize_text_field( $_POST[ $key ] );
        }
    }
    // Ensure only safe post types
    $args['post_type'] = 'post';
    $query = new WP_Query( $args );
    // ... rest of the function
}

Note: The patched code is a hypothetical example. The vendor has not released an official patch.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the Relevanssi Live Ajax Search plugin (version 2.4 or earlier) installed and active.
• The plugin must be configured to handle AJAX requests (default behavior).

Exploitation Steps:

1. Identify the AJAX endpoint: The plugin registers an AJAX action, typically relevanssi_live_search. The endpoint is /wp-admin/admin-ajax.php.

2. Craft a malicious POST request: Use curl or a tool like Burp Suite to send a POST request with injected arguments.

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=relevanssi_live_search&search=test&post_type=any&post_status=publish,private"
   

3. Analyze the response: The response will contain search results, including private posts and attachments that should not be accessible to unauthenticated users.

Expected Output: The AJAX response will include titles, excerpts, and links to private posts or attachments.

Blue Team

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action=relevanssi_live_search parameter.
• Look for requests containing unexpected parameters like post_type, post_status, or meta_query.
• Check for a high volume of requests from a single IP address.

Mitigation:

• Disable the plugin until a patch is available.
• Implement a WAF rule to block requests with suspicious parameters.
• Restrict access to admin-ajax.php using IP whitelisting or authentication.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=relevanssi_live_search and additional parameters like post_type, post_status, or meta_query.
  • Unusual response sizes from the AJAX endpoint (indicating disclosure of private content).

• File IOCs:

  • Modified or suspicious entries in the WordPress database (e.g., transient data related to search queries).

• Log IOCs:

  • Web server logs showing repeated requests to admin-ajax.php with the relevanssi_live_search action from unauthenticated users.

Detection Engineering

YARA Rule

rule Detect_Relevanssi_Argument_Injection {
    meta:
        description = "Detects argument injection attempts against Relevanssi Live Ajax Search plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-7573"
    strings:
        $ajax_action = "relevanssi_live_search"
        $dangerous_param1 = "post_type"
        $dangerous_param2 = "post_status"
        $dangerous_param3 = "meta_query"
    condition:
        $ajax_action and any of ($dangerous_param*)
}

Sigma Rule

title: Relevanssi Live Ajax Search Argument Injection
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects argument injection attempts against the Relevanssi Live Ajax Search plugin (CVE-2024-7573)
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=relevanssi_live_search'
        cs-uri-query|contains|any:
            - 'post_type'
            - 'post_status'
            - 'meta_query'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if custom post types are used)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7573 Relevanssi Live Ajax Search Argument Injection"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=relevanssi_live_search"; http_client_body; pcre:"/(post_type|post_status|meta_query)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Relevanssi Live Ajax Search plugin until a patch is released.
2. Implement a WAF rule: Block POST requests to admin-ajax.php that contain the action=relevanssi_live_search parameter along with any of the following: post_type, post_status, meta_query.
3. Monitor logs: Review web server logs for signs of exploitation.

Long-term Actions:

1. Apply vendor patch: Once Relevanssi releases a patched version (e.g., 2.5), update immediately.
2. Harden WordPress: Ensure that admin-ajax.php is not accessible to unauthenticated users unless absolutely necessary.
3. Regular audits: Periodically review installed plugins for known vulnerabilities.

Workaround:

• If the plugin is critical, restrict access to admin-ajax.php using .htaccess or a plugin like "iThemes Security" to require authentication for AJAX requests.

Valters IT
Securing Digital Frontiers