CVE-2024-13513: Oliver POS Information Disclosure Flaw

CVE-2024-13513 Overview

CVE-2024-13513 is a Sensitive Information Exposure vulnerability affecting the Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress. The vulnerability exists in all versions up to and including 2.4.2.3 and stems from improper access control in the plugin's logging functionality. This flaw enables unauthenticated attackers to access sensitive log files containing the plugin's clientToken, which can subsequently be leveraged to modify user account information including email addresses and account types—ultimately leading to complete site takeover.

Critical Impact

Unauthenticated attackers can extract sensitive authentication tokens from exposed log files, enabling account hijacking and complete WordPress site takeover without any prior authentication.

Affected Products

• Oliver POS – WooCommerce Point of Sale Plugin versions up to and including 2.4.2.3
• WordPress installations running vulnerable Oliver POS plugin versions
• Sites with existing log files remain vulnerable even after upgrading to 2.4.2.3

Discovery Timeline

• 2025-02-15 - CVE-2024-13513 published to NVD
• 2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13513

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating a fundamental flaw in the plugin's access control mechanisms. The Oliver POS plugin implements a logging functionality that inadvertently stores sensitive authentication data, specifically the clientToken, in log files that lack proper access restrictions. The exposure of this token creates a direct attack path for unauthenticated adversaries to compromise the entire WordPress installation.

The attack chain begins with an attacker accessing the exposed log files through predictable or discoverable file paths. Once the clientToken is extracted, the attacker can manipulate user account data through the plugin's API, changing email addresses and account types. With control over account information, the attacker can initiate password resets and gain administrative access to the WordPress site.

Root Cause

The root cause of this vulnerability lies in the Missing Authorization (CWE-862) implementation within the logging functionality. The plugin fails to implement adequate access controls on log files containing sensitive authentication tokens. While version 2.4.2.3 addressed the issue by disabling logging, it did not remediate sites where log files already existed, leaving a window of exposure for installations that had accumulated sensitive data in their logs prior to the update.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can remotely access the vulnerable logging endpoints or log file locations to extract the clientToken. The exploitation flow involves:

1. Reconnaissance to identify WordPress sites running the Oliver POS plugin
2. Accessing exposed log files containing the clientToken
3. Using the extracted token to modify user account information via the plugin's API
4. Escalating privileges by changing administrator email addresses and initiating password resets
5. Achieving complete control over the WordPress installation

The vulnerability is particularly severe because it allows unauthenticated attackers to chain information disclosure with account takeover, bypassing all authentication mechanisms.

Detection Methods for CVE-2024-13513

Indicators of Compromise

• Unexpected access to log files in the Oliver POS plugin directory, particularly within /wp-content/plugins/oliver-pos/
• Unusual API requests to Oliver POS endpoints involving user account modifications
• Administrator account email address changes without legitimate authorization
• Password reset requests following unexplained account modifications
• Web server logs showing access patterns targeting known log file paths

Detection Strategies

• Monitor web server access logs for requests to Oliver POS plugin directories, especially log file paths
• Implement file integrity monitoring on the WordPress plugin directory to detect unauthorized access
• Review WordPress user account audit logs for unauthorized email or role changes
• Deploy web application firewall (WAF) rules to block suspicious requests targeting plugin log files
• Monitor authentication logs for password reset attempts following account modifications

Monitoring Recommendations

• Enable verbose logging on web servers to capture all requests to plugin directories
• Configure alerts for any modifications to administrator-level WordPress accounts
• Implement SIEM rules to correlate log file access with subsequent API calls to Oliver POS endpoints
• Regularly audit the Oliver POS plugin directory for the presence of log files containing sensitive data

How to Mitigate CVE-2024-13513

Immediate Actions Required

• Update the Oliver POS plugin to the latest available version beyond 2.4.2.3
• Manually remove all existing log files from the Oliver POS plugin directory
• Rotate the clientToken if supported by the plugin configuration
• Review and reset passwords for all WordPress administrator accounts
• Audit user account changes for any unauthorized modifications

Patch Information

The vendor addressed this vulnerability by disabling the logging functionality in version 2.4.2.3. However, this update does not automatically remediate sites with pre-existing log files. Administrators must manually remove any accumulated log files to fully mitigate the risk. The WordPress Plugin Change Log provides details on the changes implemented. For additional technical context, consult the Wordfence Vulnerability Analysis.

Workarounds

• Restrict access to the Oliver POS plugin directory via web server configuration (e.g., .htaccess rules for Apache or location blocks for Nginx)
• Implement network-level access controls to limit access to the WordPress admin and plugin directories
• If the plugin is not essential, consider disabling or removing it until a comprehensive fix is available
• Deploy a web application firewall to block requests targeting known log file paths

# Apache .htaccess example to restrict access to Oliver POS logs
<Directory "/var/www/html/wp-content/plugins/oliver-pos/">
    <FilesMatch "\.(log|txt)$">
        Require all denied
    </FilesMatch>
</Directory>