CVE-2024-10828: Advanced Order Export WooCommerce RCE Flaw

CVE-2024-10828 Overview

The Advanced Order Export For WooCommerce plugin for WordPress contains a critical PHP Object Injection vulnerability affecting all versions up to and including 3.5.5. This insecure deserialization vulnerability occurs during Order export functionality when the "Try to convert serialized values" option is enabled. Unauthenticated attackers can exploit this flaw to inject malicious PHP Objects, which combined with the presence of a Property Oriented Programming (POP) chain, enables arbitrary file deletion on the server. Deleting critical files such as wp-config.php can lead to complete remote code execution and full site compromise.

Critical Impact

Unauthenticated attackers can achieve remote code execution through arbitrary file deletion, potentially compromising entire WordPress installations without requiring any authentication.

Affected Products

• Algolplus Advanced Order Export For WooCommerce (Free version) - versions up to and including 3.5.5
• Algolplus Advanced Order Export For WooCommerce (Pro version) - versions up to and including 3.5.5
• WordPress sites with the vulnerable plugin and "Try to convert serialized values" option enabled

Discovery Timeline

• 2024-11-13 - CVE-2024-10828 published to NVD
• 2024-11-19 - Last updated in NVD database

Technical Details for CVE-2024-10828

Vulnerability Analysis

This PHP Object Injection vulnerability (CWE-502: Deserialization of Untrusted Data) exists in the order export functionality of the Advanced Order Export For WooCommerce plugin. The vulnerability is triggered when the plugin processes serialized data during order exports with the "Try to convert serialized values" configuration option enabled.

The core issue lies in the unsafe deserialization of user-controllable input without proper validation or sanitization. When the plugin attempts to convert serialized values, it uses PHP's native unserialize() function on data that can be influenced by attackers. This allows malicious actors to craft specially formed serialized PHP objects that, when deserialized, execute arbitrary code through magic methods.

The presence of an exploitable POP (Property Oriented Programming) chain within the plugin's codebase or its dependencies significantly amplifies the impact. Specifically, the chain enables attackers to delete arbitrary files on the server filesystem. By targeting critical WordPress files such as wp-config.php, attackers can trigger the WordPress installation process, allowing them to reconfigure the site with attacker-controlled database credentials and ultimately achieve full remote code execution.

Root Cause

The root cause of this vulnerability is the use of PHP's unserialize() function on untrusted input data without proper validation. The vulnerable code paths can be found in the WOE Core Extractor trait and the PHPExcel Shared XMLWriter class. The plugin fails to implement safe deserialization practices such as:

• Input validation before deserialization
• Allowlist of permitted classes during unserialize operations (available in PHP 7.0+ via the allowed_classes option)
• Alternative safe data interchange formats like JSON

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying WordPress installations using the vulnerable Advanced Order Export For WooCommerce plugin
2. Crafting a malicious serialized PHP object payload that leverages the available POP chain
3. Submitting the payload through the order export functionality
4. The deserialization process instantiates the malicious object and triggers the POP chain
5. The POP chain executes file deletion operations, removing critical files like wp-config.php
6. With the configuration file removed, WordPress enters setup mode, allowing the attacker to reconfigure the installation with malicious settings

The vulnerability mechanism relies on PHP's magic methods (such as __destruct(), __wakeup(), or __toString()) being called during or after the deserialization process. Technical details and code analysis can be found in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-10828

Indicators of Compromise

• Unexpected deletion of critical WordPress files such as wp-config.php, .htaccess, or plugin/theme files
• WordPress installation prompts appearing unexpectedly on established sites
• Unusual serialized data patterns in web server access logs, particularly containing PHP class names in POST data to WooCommerce export endpoints
• Database modifications or new administrator accounts created after WordPress "reinstallation"

Detection Strategies

• Monitor web application firewall (WAF) logs for serialized PHP object patterns in requests to WooCommerce export endpoints
• Implement file integrity monitoring (FIM) to detect unauthorized deletion or modification of core WordPress files
• Review access logs for requests containing serialized data payloads with suspicious class instantiation patterns
• Deploy runtime application self-protection (RASP) solutions capable of detecting deserialization attacks

Monitoring Recommendations

• Enable verbose logging for the Advanced Order Export For WooCommerce plugin and monitor for export operations from unusual sources
• Set up alerts for any modifications or deletions of wp-config.php and other critical WordPress configuration files
• Monitor for unexpected WordPress setup/installation page access patterns
• Implement anomaly detection for order export API endpoints to identify unusual request patterns or payload sizes

How to Mitigate CVE-2024-10828

Immediate Actions Required

• Update the Advanced Order Export For WooCommerce plugin to version 3.5.6 or later immediately
• Disable the "Try to convert serialized values" option in the plugin settings until the update is applied
• Implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP object patterns
• Review recent export activity logs for any suspicious operations

Patch Information

The vulnerability has been addressed by Algolplus in versions released after 3.5.5. Administrators should update to the latest available version of the Advanced Order Export For WooCommerce plugin through the WordPress plugin repository. Both the Free and Pro versions require updating. After updating, verify the plugin version by checking the plugin details in the WordPress admin dashboard under Plugins > Installed Plugins.

Workarounds

• Disable the "Try to convert serialized values" option in the plugin's export settings (Settings > Export Options) as a temporary mitigation
• Restrict access to the WordPress admin area and WooCommerce export functionality to trusted IP addresses only
• Implement strict WAF rules to filter and block serialized PHP object patterns in incoming requests
• Consider temporarily deactivating the plugin if it's not critical to operations until the patch can be applied

# Configuration example - Disable plugin via WP-CLI if immediate deactivation is needed
wp plugin deactivate woo-order-export-lite

# Verify current plugin version
wp plugin get woo-order-export-lite --field=version

# Update plugin to latest version
wp plugin update woo-order-export-lite

# For Apache - Block serialized object patterns (add to .htaccess)
# RewriteEngine On
# RewriteCond %{QUERY_STRING} (O:|a:|s:)[0-9]+: [NC,OR]
# RewriteCond %{REQUEST_BODY} (O:|a:|s:)[0-9]+: [NC]
# RewriteRule .* - [F,L]