CVE-2024-10124: Vayu Blocks Auth Bypass Vulnerability

CVE-2024-10124 Overview

The Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce plugin for WordPress contains a critical authorization bypass vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins on affected WordPress installations. The vulnerability exists due to a missing capability check on the tp_install() function in all versions up to and including 1.1.1, enabling complete compromise of WordPress sites through remote code execution when combined with malicious plugin installation.

Critical Impact

Unauthenticated attackers can install and activate arbitrary WordPress plugins, leading to remote code execution, complete site takeover, data theft, and malware distribution through compromised websites.

Affected Products

• Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce versions up to and including 1.1.1
• WordPress installations running vulnerable Vayu Blocks plugin versions
• WooCommerce sites utilizing Vayu Blocks for Gutenberg block functionality

Discovery Timeline

• 2024-12-12 - CVE-2024-10124 published to NVD
• 2024-12-12 - Last updated in NVD database

Technical Details for CVE-2024-10124

Vulnerability Analysis

This vulnerability represents a severe authorization bypass (CWE-284: Improper Access Control) in the Vayu Blocks WordPress plugin. The core issue stems from the tp_install() function lacking proper capability verification before executing plugin installation operations. In WordPress's security model, plugin installation should be restricted to administrators with the install_plugins capability, but this check was entirely absent from the vulnerable code path.

The attack chain is straightforward and devastating: an unauthenticated remote attacker can invoke the plugin installation functionality directly, bypassing all intended access controls. This allows arbitrary plugin installation from the WordPress plugin repository or potentially from external sources, depending on the implementation. Once a malicious or known-vulnerable plugin is installed and activated, attackers can achieve remote code execution on the underlying server.

The vulnerability was partially addressed in version 1.1.1, with a more complete fix released in version 1.2.0 based on the changeset references available in the WordPress plugin repository.

Root Cause

The root cause is a missing capability check in the tp_install() function within the app.php file. WordPress requires explicit capability verification using functions like current_user_can('install_plugins') before performing privileged operations. The vulnerable code directly processed plugin installation requests without validating that the requesting user had appropriate administrative permissions, resulting in a complete authorization bypass that allows unauthenticated access.

Attack Vector

The attack is network-based and requires no authentication, user interaction, or special privileges. An attacker can remotely send crafted HTTP requests to the vulnerable AJAX endpoint or REST API handler associated with the tp_install() function. The attack flow typically involves:

1. Identifying WordPress sites running vulnerable Vayu Blocks versions through fingerprinting
2. Crafting a malicious request targeting the unprotected installation endpoint
3. Installing a malicious plugin or a plugin with known vulnerabilities
4. Activating the installed plugin to establish persistent access
5. Leveraging the installed plugin for remote code execution, backdoor creation, or further exploitation

The vulnerability in the Installation class at class-installation.php facilitates the actual plugin deployment process once the authorization check is bypassed. Technical details are available in the WordPress Vayu Blocks Code Reference and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-10124

Indicators of Compromise

• Unexpected plugins appearing in the WordPress plugins directory (/wp-content/plugins/) without administrator installation
• Unusual AJAX or REST API requests targeting Vayu Blocks installation endpoints in web server access logs
• New or modified PHP files in plugin directories that were not legitimately installed
• Unauthorized administrator accounts or privilege changes following exploitation
• Web shell or backdoor files created by malicious plugins installed through the vulnerability

Detection Strategies

• Monitor WordPress plugin directory for unauthorized additions or modifications using file integrity monitoring (FIM) tools
• Review web server access logs for requests to /wp-admin/admin-ajax.php with suspicious tp_install action parameters from external IPs
• Implement web application firewall (WAF) rules to detect and block unauthorized plugin installation attempts
• Use WordPress security plugins to alert on unexpected plugin installations or activations
• Conduct regular WordPress plugin audits to identify unfamiliar or unauthorized plugins

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX and REST API endpoints to capture installation attempts
• Configure SIEM correlation rules to alert on multiple plugin installation requests from non-authenticated sessions
• Monitor for new PHP file creation events within the WordPress installation directory structure
• Set up alerts for changes to the active_plugins option in the WordPress database
• Implement network-level monitoring for outbound connections from the web server that may indicate post-exploitation activity

How to Mitigate CVE-2024-10124

Immediate Actions Required

• Update Vayu Blocks plugin to version 1.2.0 or later immediately, as this version contains the complete security fix
• If immediate update is not possible, deactivate and delete the Vayu Blocks plugin until patching is feasible
• Audit the WordPress plugins directory for any unauthorized or suspicious plugins that may have been installed
• Review WordPress user accounts for any unauthorized administrator accounts created through exploitation
• Scan the entire WordPress installation for web shells, backdoors, or other malicious code

Patch Information

The vulnerability was partially patched in version 1.1.1 and fully remediated in version 1.2.0. The fix implements proper capability checks before allowing plugin installation operations. Administrators should update to version 1.2.0 or later through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

Patch details can be reviewed at:

• WordPress Vayu Blocks Changeset 3173408
• WordPress Vayu Blocks Changeset Release 1.2.0

Workarounds

• Disable or remove the Vayu Blocks plugin entirely if updating is not immediately possible
• Implement WAF rules to block requests targeting the vulnerable tp_install functionality
• Restrict access to WordPress admin AJAX endpoints at the web server level using IP whitelisting
• Enable WordPress automatic updates for plugins to receive security patches as soon as they become available
• Consider using a security plugin with virtual patching capabilities to protect against exploitation while awaiting updates

# WordPress CLI command to deactivate and remove vulnerable plugin
wp plugin deactivate vayu-blocks --path=/var/www/html/wordpress
wp plugin delete vayu-blocks --path=/var/www/html/wordpress

# After confirming fix, install updated version
wp plugin install vayu-blocks --version=1.2.0 --activate --path=/var/www/html/wordpress