CVE-2024-8522: LearnPress WordPress Plugin SQLi Flaw

CVE-2024-8522 Overview

CVE-2024-8522 is a critical SQL Injection vulnerability affecting the LearnPress WordPress LMS Plugin. The vulnerability exists in the c_only_fields parameter of the /wp-json/learnpress/v1/courses REST API endpoint in all versions up to and including 4.2.7. Due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query, unauthenticated attackers can append additional SQL queries into already existing queries to extract sensitive information from the database.

LearnPress is a popular WordPress plugin used for creating and managing Learning Management System (LMS) functionality, making this vulnerability particularly concerning for educational institutions and online course providers.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from WordPress databases, including user credentials, course information, and potentially administrative access details without any authentication requirements.

Affected Products

• ThimPress LearnPress versions up to and including 4.2.7
• WordPress installations running vulnerable LearnPress plugin versions
• Any WordPress LMS site utilizing the LearnPress REST API endpoint

Discovery Timeline

• 2024-09-12 - CVE-2024-8522 published to NVD
• 2024-09-13 - Last updated in NVD database

Technical Details for CVE-2024-8522

Vulnerability Analysis

This SQL Injection vulnerability resides in the LearnPress REST API controller, specifically in the class-lp-rest-courses-v1-controller.php file. The vulnerable endpoint at /wp-json/learnpress/v1/courses accepts user input through the c_only_fields parameter without proper sanitization or parameterized query preparation.

The vulnerability allows unauthenticated remote attackers to manipulate SQL queries executed by the WordPress database. Since no authentication is required to access the REST API endpoint, the attack surface is significantly expanded. The flaw enables data extraction from the database but does not appear to allow data modification or deletion based on the confidentiality-only impact assessment.

With an extremely high EPSS probability of 86.508% (99th percentile), this vulnerability is highly likely to be exploited in the wild, making immediate patching essential.

Root Cause

The root cause of CVE-2024-8522 is improper input validation and the lack of prepared statements in the SQL query construction. The c_only_fields parameter is directly incorporated into database queries without proper escaping or parameterization, violating secure coding practices for database interactions in WordPress development.

The vulnerable code path can be found in the REST API version 1 controller for courses. WordPress provides the $wpdb->prepare() method specifically to prevent SQL Injection attacks, but this was not properly implemented for the affected parameter.

Attack Vector

The attack vector is network-based, requiring no authentication, no user interaction, and presenting low attack complexity. An attacker can exploit this vulnerability by sending crafted HTTP requests to the REST API endpoint with malicious SQL payloads in the c_only_fields parameter.

The vulnerability is exploited through the /wp-json/learnpress/v1/courses REST API endpoint. Attackers can craft malicious requests containing SQL injection payloads within the c_only_fields parameter to manipulate database queries and extract sensitive information. For detailed technical analysis, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-8522

Indicators of Compromise

• Unusual or malformed requests to /wp-json/learnpress/v1/courses endpoint containing SQL syntax in the c_only_fields parameter
• Database query logs showing unexpected UNION, SELECT, or other SQL injection patterns originating from REST API calls
• Abnormal data access patterns or bulk data extraction from WordPress database tables
• Web server access logs showing repeated requests with encoded SQL payloads targeting the LearnPress API

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in REST API parameters
• Implement logging and monitoring for all requests to LearnPress REST API endpoints
• Use database activity monitoring to detect anomalous query patterns or unauthorized data access
• Scan WordPress installations using vulnerability scanners that check for outdated LearnPress versions

Monitoring Recommendations

• Monitor web server access logs for requests containing SQL injection signatures targeting /wp-json/learnpress/v1/courses
• Enable WordPress debug logging to capture suspicious database query activity
• Set up alerts for any requests with special characters or SQL keywords in the c_only_fields parameter
• Regularly audit database access logs for unusual SELECT queries against user and course tables

How to Mitigate CVE-2024-8522

Immediate Actions Required

• Update LearnPress plugin to version 4.2.7.1 or later immediately
• Review web server access logs for signs of exploitation attempts
• Temporarily disable the LearnPress REST API if immediate patching is not possible
• Implement WAF rules to block SQL injection attempts targeting the vulnerable endpoint

Patch Information

ThimPress has released version 4.2.7.1 of the LearnPress plugin which addresses this SQL Injection vulnerability. The patch implements proper input sanitization and prepared statements for the c_only_fields parameter.

The security fix can be reviewed in the WordPress Plugin Changeset History.

To update the plugin, navigate to your WordPress admin dashboard, go to Plugins > Installed Plugins, find LearnPress, and click "Update Now" if an update is available. Alternatively, download the latest version from the WordPress plugin repository and perform a manual update.

Workarounds

• Restrict access to the REST API endpoint /wp-json/learnpress/v1/courses using server-level configuration until patching is possible
• Implement a WAF rule to block requests containing SQL keywords in the c_only_fields parameter
• Disable the LearnPress REST API functionality if not required for site operations
• Use .htaccess or nginx configuration to limit REST API access to trusted IP addresses

# Nginx configuration to restrict LearnPress REST API access
location ~ ^/wp-json/learnpress/v1/courses {
    # Block requests with suspicious c_only_fields parameter values
    if ($arg_c_only_fields ~* "(union|select|insert|update|delete|drop|--|')") {
        return 403;
    }
    # Alternatively, restrict to trusted IPs only
    # allow 192.168.1.0/24;
    # deny all;
}