CVE-2024-37099: GiveWP Object Injection Vulnerability

CVE-2024-37099 Overview

CVE-2024-37099 is an Insecure Deserialization vulnerability affecting the GiveWP donation plugin for WordPress. This vulnerability allows unauthenticated attackers to perform PHP Object Injection attacks by exploiting improper handling of untrusted data during deserialization operations. The vulnerability affects GiveWP versions through 3.14.1.

Critical Impact
Unauthenticated attackers can exploit this PHP Object Injection vulnerability to potentially achieve remote code execution, data manipulation, or complete site compromise on WordPress installations using vulnerable versions of the GiveWP plugin.

Affected Products

GiveWP WordPress plugin versions up to and including 3.14.1
WordPress sites utilizing the GiveWP donation functionality
Liquid Web hosted environments running vulnerable GiveWP versions

Discovery Timeline

2024-08-19 - CVE-2024-37099 published to NVD
2025-02-28 - Last updated in NVD database

Technical Details for CVE-2024-37099

Vulnerability Analysis

This vulnerability stems from improper handling of serialized data within the GiveWP plugin. PHP Object Injection occurs when user-controllable input is passed to the unserialize() function without proper validation or sanitization. When exploited, attackers can instantiate arbitrary PHP objects with attacker-controlled properties.

The critical nature of this vulnerability lies in its unauthenticated attack surface, meaning no prior authentication or user interaction is required for exploitation. When combined with existing POP (Property-Oriented Programming) chains within the WordPress ecosystem or GiveWP plugin itself, attackers can potentially chain object instantiations to achieve arbitrary code execution.

Root Cause

The root cause is classified under CWE-502 (Deserialization of Untrusted Data). The GiveWP plugin fails to properly validate or sanitize serialized data before passing it to PHP's deserialization functions. This allows malicious serialized payloads to be processed by the application, instantiating arbitrary objects with attacker-controlled properties.

In PHP applications, when unserialize() processes malicious input, it can trigger magic methods such as __wakeup(), __destruct(), or __toString() on instantiated objects. If a suitable gadget chain exists within the application or its dependencies, these methods can be leveraged to execute arbitrary code.

Attack Vector

The attack is conducted over the network without requiring authentication. An attacker can craft a malicious serialized PHP payload and submit it through vulnerable input vectors in the GiveWP plugin. The payload would typically:

Target an endpoint that processes user input through deserialization
Include serialized objects that chain together vulnerable class methods
Leverage existing gadget chains in WordPress or GiveWP to achieve code execution

The exploitation mechanism relies on the presence of exploitable classes (gadgets) within the WordPress environment. Common exploitation outcomes include file writes, remote code execution via system commands, or database manipulation. For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-37099

Indicators of Compromise

Unusual serialized data patterns in HTTP POST requests containing PHP object notation (e.g., O:4:"User":1:{...})
Unexpected file system modifications or new files created in plugin directories
Anomalous database queries or modifications originating from the GiveWP plugin context
Web server logs showing malformed or unusually large POST requests to GiveWP endpoints

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
Monitor for suspicious unserialize() calls in PHP error logs or application debugging output
Deploy runtime application self-protection (RASP) solutions capable of detecting deserialization attacks
Conduct regular security audits of WordPress installations to identify vulnerable plugin versions

Monitoring Recommendations

Enable verbose logging on WordPress installations to capture detailed request information
Configure alerting for file integrity monitoring on WordPress core, theme, and plugin directories
Implement network-level monitoring for outbound connections from the web server that may indicate successful exploitation
Review access logs for POST requests to GiveWP-specific endpoints with unusually large payloads

How to Mitigate CVE-2024-37099

Immediate Actions Required

Update GiveWP plugin to the latest version that addresses this vulnerability (versions after 3.14.1)
Audit WordPress installations for any signs of compromise if vulnerable versions were deployed
Temporarily disable the GiveWP plugin if an immediate update is not possible
Review and remove any suspicious files or database entries that may indicate prior exploitation

Patch Information

GiveWP has released updated versions of the plugin to address this vulnerability. WordPress site administrators should update to the latest available version through the WordPress plugin repository. The fix involves implementing proper input validation and avoiding unsafe deserialization of user-controlled data.

Updates can be applied through the WordPress admin dashboard by navigating to Plugins > Installed Plugins and clicking "Update Now" for the GiveWP plugin. Alternatively, use WP-CLI: wp plugin update give.

Workarounds

Implement a WAF rule to block requests containing serialized PHP object patterns
Restrict access to donation form endpoints using IP-based access controls if possible
Consider using PHP's allowed_classes parameter in any custom deserialization as a defense-in-depth measure
Enable WordPress security plugins with object injection detection capabilities

bash

# Example WAF rule pattern for ModSecurity to detect PHP serialization attacks
SecRule REQUEST_BODY "@rx O:\d+:\"[a-zA-Z0-9_]+\":\d+:\{" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'Potential PHP Object Injection Attack Detected',\
    tag:'application-multi',\
    tag:'language-php',\
    tag:'platform-multi',\
    tag:'attack-injection-php'"