CVE-2024-8529: Thimpress LearnPress SQL Injection Flaw

CVE-2024-8529 Overview

CVE-2024-8529 is a SQL Injection vulnerability affecting the LearnPress WordPress LMS Plugin, a popular learning management system plugin for WordPress. The vulnerability exists in the c_fields parameter of the /wp-json/lp/v1/courses/archive-course REST API endpoint in all versions up to and including 4.2.7. Due to insufficient escaping on user-supplied parameters and lack of sufficient preparation on existing SQL queries, unauthenticated attackers can append additional SQL queries to extract sensitive information from the database.

Critical Impact

This SQL Injection vulnerability allows unauthenticated attackers to extract sensitive information from WordPress databases, potentially exposing user credentials, personal data, and administrative information without requiring any authentication.

Affected Products

• ThimPress LearnPress plugin for WordPress versions up to and including 4.2.7
• WordPress websites utilizing the LearnPress LMS Plugin
• All LearnPress installations with exposed REST API endpoints

Discovery Timeline

• September 12, 2024 - CVE-2024-8529 published to NVD
• September 13, 2024 - Last updated in NVD database

Technical Details for CVE-2024-8529

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the LearnPress WordPress LMS Plugin's REST API functionality. The vulnerability is exploitable over the network without requiring any authentication or user interaction, making it particularly dangerous for exposed WordPress installations. The flaw allows attackers to compromise the confidentiality of the database by extracting sensitive information, though it does not directly impact data integrity or system availability.

The vulnerable endpoint is the /wp-json/lp/v1/courses/archive-course REST API, which processes the c_fields parameter without adequate input sanitization or parameterized query preparation.

Root Cause

The root cause of CVE-2024-8529 is improper input validation and insufficient SQL query preparation. The LearnPress plugin fails to properly escape user-supplied input in the c_fields parameter before incorporating it into SQL queries. This lack of prepared statements or parameterized queries allows malicious SQL code to be injected and executed against the WordPress database.

Attack Vector

The attack vector is network-based, targeting the WordPress REST API endpoint. An attacker can craft malicious requests to the /wp-json/lp/v1/courses/archive-course endpoint with specially crafted c_fields parameter values containing SQL injection payloads. Since the endpoint is accessible without authentication, any remote attacker with network access to the WordPress installation can exploit this vulnerability.

The exploitation process involves sending crafted HTTP requests to the vulnerable REST API endpoint with malicious SQL statements embedded in the c_fields parameter. The injected SQL code is then executed against the database, allowing the attacker to perform UNION-based or error-based SQL injection attacks to enumerate database contents and extract sensitive data including user credentials, email addresses, and other stored information.

Detection Methods for CVE-2024-8529

Indicators of Compromise

• Unusual HTTP requests to /wp-json/lp/v1/courses/archive-course containing SQL keywords in the c_fields parameter
• Database query logs showing unexpected UNION SELECT or other SQL injection patterns
• Anomalous traffic patterns to WordPress REST API endpoints from unknown IP addresses
• Error messages in web server logs related to SQL syntax errors on the LearnPress API endpoint

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting LearnPress REST API endpoints
• Implement intrusion detection rules to identify requests containing SQL keywords (UNION, SELECT, DROP, INSERT) in the c_fields parameter
• Review WordPress and web server access logs for suspicious requests to /wp-json/lp/v1/courses/archive-course
• Deploy database activity monitoring to detect unauthorized data extraction queries

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests
• Configure alerts for multiple failed or malformed API requests from single IP addresses
• Implement rate limiting on REST API endpoints to slow potential exploitation attempts
• Monitor database query logs for anomalous patterns or data exfiltration attempts

How to Mitigate CVE-2024-8529

Immediate Actions Required

• Update LearnPress plugin to version 4.2.7.1 or later immediately
• Review database logs for signs of previous exploitation attempts
• Consider temporarily disabling the LearnPress REST API if immediate patching is not possible
• Audit WordPress user accounts for unauthorized modifications or new administrator accounts

Patch Information

ThimPress has released version 4.2.7.1 of the LearnPress plugin which addresses this SQL Injection vulnerability. The patch implements proper input sanitization and prepared SQL statements for the affected c_fields parameter. Administrators should update through the WordPress plugin repository or download the patched version directly. The changeset documenting the fix is available in the WordPress Plugin Change Log. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts on LearnPress endpoints
• Restrict access to the WordPress REST API using .htaccess or server configuration if the course archive functionality is not required
• Implement IP-based access controls to limit REST API access to trusted networks only
• Consider using security plugins like Wordfence that provide virtual patching capabilities for known vulnerabilities

# Example .htaccess rule to restrict LearnPress REST API access
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/lp/v1/courses/archive-course [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. 
RewriteRule .* - [F,L]
</IfModule>