CVE-2024-6624: JSON API User Privilege Escalation Flaw

CVE-2024-6624 Overview

CVE-2024-6624 is a critical privilege escalation vulnerability affecting the JSON API User plugin for WordPress in all versions up to and including 3.9.3. The vulnerability stems from improper controls on custom user meta fields, allowing unauthenticated attackers to register as administrators on vulnerable WordPress sites. This plugin requires the JSON API plugin to also be installed, which extends the attack surface for WordPress installations using this combination.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to gain full administrative access to WordPress sites, potentially leading to complete site takeover, data theft, malware injection, and further compromise of the underlying infrastructure.

Affected Products

• JSON API User plugin for WordPress versions up to and including 3.9.3
• WordPress sites with both JSON API and JSON API User plugins installed
• parorrey json_api_user (all vulnerable versions)

Discovery Timeline

• 2024-07-11 - CVE-2024-6624 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6624

Vulnerability Analysis

This privilege escalation vulnerability exists within the JSON API User plugin's user registration and management functionality. The core issue lies in how the plugin handles custom user meta fields during the user registration process. When users register through the JSON API endpoints, the plugin fails to properly validate and restrict which meta fields can be set by the registering user.

In WordPress, user capabilities and roles are stored as user meta data. By manipulating the registration request to include privileged meta fields, an attacker can effectively assign themselves administrative capabilities. The vulnerability is particularly dangerous because it requires no prior authentication—any remote attacker can exploit it simply by crafting a malicious registration request.

The attack surface is exposed through the plugin's User controller, specifically in the functions handling user creation and updates. The vulnerability allows attackers to bypass the intended access controls and set arbitrary user meta values that should be restricted to administrators only.

Root Cause

The root cause of CVE-2024-6624 is improper access control implementation in the JSON API User plugin's handling of user meta fields. The plugin fails to implement a whitelist of allowed meta fields that users can set during registration, nor does it blacklist sensitive meta keys related to user roles and capabilities. This oversight allows untrusted input from unauthenticated users to directly influence security-critical user attributes stored in the WordPress database.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the WordPress JSON API endpoints exposed by the plugin combination. The attack flow involves:

1. Identifying a WordPress site running both the JSON API and JSON API User plugins
2. Crafting a registration request that includes manipulated user meta fields
3. Submitting the request to the site's API endpoint to create a new user account with elevated privileges
4. Using the newly created administrator account to gain full control of the WordPress site

The vulnerability is accessible remotely over the network, and the technical complexity of exploitation is low, making it highly exploitable in the wild.

Detection Methods for CVE-2024-6624

Indicators of Compromise

• Unexpected administrator accounts appearing in the WordPress user database
• User registration activity through API endpoints from suspicious IP addresses
• Unusual API requests to /json-api/ or similar JSON API endpoints with extended meta parameters
• New users with administrative capabilities that weren't created by existing administrators
• Log entries showing user registration requests containing wp_capabilities or wp_user_level meta fields

Detection Strategies

• Monitor WordPress user creation events, especially those occurring through API endpoints rather than the standard admin interface
• Implement web application firewall (WAF) rules to detect and block registration requests containing privileged meta field names
• Review access logs for POST requests to JSON API endpoints with suspicious payload patterns
• Set up alerts for any new administrator account creation that bypasses normal administrative workflows

Monitoring Recommendations

• Enable comprehensive logging for all WordPress API activity, including the JSON API plugin endpoints
• Configure SIEM rules to correlate user registration events with subsequent privilege escalation indicators
• Regularly audit the WordPress user database for accounts with administrator privileges, comparing against authorized administrator lists
• Deploy endpoint detection solutions to monitor for post-exploitation activities following successful privilege escalation

How to Mitigate CVE-2024-6624

Immediate Actions Required

• Update the JSON API User plugin to the latest patched version immediately
• Audit your WordPress user database for any unauthorized administrator accounts that may have been created through exploitation
• Temporarily disable the JSON API User plugin if immediate patching is not possible
• Review web server access logs for evidence of exploitation attempts targeting the JSON API endpoints
• Revoke and regenerate all administrator credentials if compromise is suspected

Patch Information

A security patch addressing CVE-2024-6624 has been released by the plugin maintainer. The fix is available through the WordPress Changeset Update. Users should update to the latest version of the JSON API User plugin through the WordPress plugin update mechanism or by manually downloading and installing the patched version from the WordPress plugin repository.

Additional technical details about the vulnerable code can be found in the WordPress User Controller Code and the Wordfence Vulnerability Intelligence report.

Workarounds

• Disable the JSON API User plugin entirely until the patch can be applied
• Implement strict web application firewall (WAF) rules to block requests containing user meta manipulation parameters
• Restrict access to JSON API endpoints using server-level access controls such as IP whitelisting
• Disable user registration functionality at the WordPress level if it is not a required feature
• Consider using alternative plugins for API-based user management that have been audited for similar vulnerabilities

# Example: Restrict access to JSON API endpoints via .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^.*json-api.*$ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. 
RewriteRule .* - [F,L]
</IfModule>