CVE-2024-37099: GiveWP Object Injection Vulnerability

CVE-2024-37099 Overview

CVE-2024-37099 is an Insecure Deserialization vulnerability affecting the GiveWP donation plugin for WordPress. This vulnerability allows unauthenticated attackers to perform PHP Object Injection attacks by exploiting improper handling of untrusted data during deserialization operations. The vulnerability affects GiveWP versions through 3.14.1.

Critical Impact

Unauthenticated attackers can exploit this PHP Object Injection vulnerability to potentially achieve remote code execution, data manipulation, or complete site compromise on WordPress installations using vulnerable versions of the GiveWP plugin.

Affected Products

• GiveWP WordPress plugin versions up to and including 3.14.1
• WordPress sites utilizing the GiveWP donation functionality
• Liquid Web hosted environments running vulnerable GiveWP versions

Discovery Timeline

• 2024-08-19 - CVE-2024-37099 published to NVD
• 2025-02-28 - Last updated in NVD database

Technical Details for CVE-2024-37099

Vulnerability Analysis

This vulnerability stems from improper handling of serialized data within the GiveWP plugin. PHP Object Injection occurs when user-controllable input is passed to the unserialize() function without proper validation or sanitization. When exploited, attackers can instantiate arbitrary PHP objects with attacker-controlled properties.

The critical nature of this vulnerability lies in its unauthenticated attack surface, meaning no prior authentication or user interaction is required for exploitation. When combined with existing POP (Property-Oriented Programming) chains within the WordPress ecosystem or GiveWP plugin itself, attackers can potentially chain object instantiations to achieve arbitrary code execution.

Root Cause

The root cause is classified under CWE-502 (Deserialization of Untrusted Data). The GiveWP plugin fails to properly validate or sanitize serialized data before passing it to PHP's deserialization functions. This allows malicious serialized payloads to be processed by the application, instantiating arbitrary objects with attacker-controlled properties.

In PHP applications, when unserialize() processes malicious input, it can trigger magic methods such as __wakeup(), __destruct(), or __toString() on instantiated objects. If a suitable gadget chain exists within the application or its dependencies, these methods can be leveraged to execute arbitrary code.

Attack Vector

The attack is conducted over the network without requiring authentication. An attacker can craft a malicious serialized PHP payload and submit it through vulnerable input vectors in the GiveWP plugin. The payload would typically:

1. Target an endpoint that processes user input through deserialization
2. Include serialized objects that chain together vulnerable class methods
3. Leverage existing gadget chains in WordPress or GiveWP to achieve code execution

The exploitation mechanism relies on the presence of exploitable classes (gadgets) within the WordPress environment. Common exploitation outcomes include file writes, remote code execution via system commands, or database manipulation. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-37099

Indicators of Compromise

• Unusual serialized data patterns in HTTP POST requests containing PHP object notation (e.g., O:4:"User":1:{...})
• Unexpected file system modifications or new files created in plugin directories
• Anomalous database queries or modifications originating from the GiveWP plugin context
• Web server logs showing malformed or unusually large POST requests to GiveWP endpoints

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
• Monitor for suspicious unserialize() calls in PHP error logs or application debugging output
• Deploy runtime application self-protection (RASP) solutions capable of detecting deserialization attacks
• Conduct regular security audits of WordPress installations to identify vulnerable plugin versions

Monitoring Recommendations

• Enable verbose logging on WordPress installations to capture detailed request information
• Configure alerting for file integrity monitoring on WordPress core, theme, and plugin directories
• Implement network-level monitoring for outbound connections from the web server that may indicate successful exploitation
• Review access logs for POST requests to GiveWP-specific endpoints with unusually large payloads

How to Mitigate CVE-2024-37099

Immediate Actions Required

• Update GiveWP plugin to the latest version that addresses this vulnerability (versions after 3.14.1)
• Audit WordPress installations for any signs of compromise if vulnerable versions were deployed
• Temporarily disable the GiveWP plugin if an immediate update is not possible
• Review and remove any suspicious files or database entries that may indicate prior exploitation

Patch Information

GiveWP has released updated versions of the plugin to address this vulnerability. WordPress site administrators should update to the latest available version through the WordPress plugin repository. The fix involves implementing proper input validation and avoiding unsafe deserialization of user-controlled data.

Updates can be applied through the WordPress admin dashboard by navigating to Plugins > Installed Plugins and clicking "Update Now" for the GiveWP plugin. Alternatively, use WP-CLI: wp plugin update give.

Workarounds

• Implement a WAF rule to block requests containing serialized PHP object patterns
• Restrict access to donation form endpoints using IP-based access controls if possible
• Consider using PHP's allowed_classes parameter in any custom deserialization as a defense-in-depth measure
• Enable WordPress security plugins with object injection detection capabilities

# Example WAF rule pattern for ModSecurity to detect PHP serialization attacks
SecRule REQUEST_BODY "@rx O:\d+:\"[a-zA-Z0-9_]+\":\d+:\{" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Potential PHP Object Injection Attack Detected',\
    tag:'application-multi',\
    tag:'language-php',\
    tag:'platform-multi',\
    tag:'attack-injection-php'"