200,000 WordPress Sites Exposed to Cyber Attack, Following Plugin Vulnerability

A critical security vulnerability has been discovered in the popular WordPress plugin Anti-Spam by CleanTalk, which is installed on over 200,000 websites.

The vulnerability, which includes two distinct flaws (CVE-2024-10542 and CVE-2024-10781), could allow attackers to install and activate arbitrary plugins on affected websites, potentially leading to remote code execution and full site compromise.

Website owners are urged to take immediate action by updating to the latest version of the plugin to secure their sites.

Vulnerabilities Overview

CVE-2024-10542: Authorization Bypass via Reverse DNS Spoofing

This vulnerability allows attackers to bypass authorization checks using reverse DNS spoofing.

By exploiting the checkWithoutToken() function, attackers can impersonate the CleanTalk servers, enabling them to install and activate arbitrary plugins without authentication.

• Patched Version: 6.44

CVE-2024-10781: Authorization Bypass due to Missing Empty Value Check

This flaw exposes websites to unauthorized actions when the plugin’s API key is left configured.

Attackers can exploit this by authorizing themselves with an empty API key hash, and performing actions such as plugin installation or activation.

• Patched Version: 6.45

Both vulnerabilities are classified as critical due to their potential to allow remote code execution, which could compromise the integrity and security of affected websites.

Wordfence Premium, Care, and Response users already have active firewall rules to safeguard against these vulnerabilities.

Technical Analysis

Authorization Bypass via Reverse DNS Spoofing (CVE-2024-10542)

The flaw resides in the checkWithoutToken() function, which checks whether a request originates from a CleanTalk server.

However, the verification relies on the gethostbyaddr() function, which can be tricked via DNS spoofing.

An attacker can craft a subdomain containing “cleantalk.org” (e.g., cleantalk.org.evilsite.com) to pass the check and bypass authorization. This grants the attacker the ability to install or activate malicious plugins.

Vulnerable Code Snippet:

public static function checkWithoutToken()
{
    global $apbct;
    $is_noc_request = ! $apbct->key_is_ok &&
        Request::get('spbc_remote_call_action') &&
        in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct')) &&
        strpos(Helper::ipResolve(Helper::ipGet()), 'cleantalk.org') !== false;
}

The misuse of strpos() to check for the cleantalk.org string makes this function vulnerable to spoofing attacks.

Authorization Bypass due to Missing Empty Value Check (CVE-2024-10781)

The second vulnerability stems from a lack of validation for empty API keys. If the plugin’s API key is not configured, attackers can exploit the fallback logic to authorize themselves by matching an empty hash value.

This issue is particularly severe as it affects unconfigured plugins, which may be common among less experienced site administrators.

Vulnerable Code Snippet:

if (
    ($token === strtolower(md5($apbct->api_key)) ||
     $token === strtolower(hash('sha256', $apbct->api_key))) ||
    self::checkWithoutToken()
) {
    // Authorization logic
}

Without an API key, the hash comparison becomes trivial, allowing attackers to bypass security measures.

The vulnerabilities were responsibly disclosed through the Wordfence Bug Bounty Program by researchers mikemyers and István Márton.

The program incentivizes ethical hacking to identify and address vulnerabilities in WordPress plugins, with mikemyers receiving a bounty of $4,095 for their discovery.

Wordfence’s mission to secure the web continues to drive improvements in WordPress security. The discovery of these critical vulnerabilities highlights the importance of timely updates and proactive security measures for WordPress site owners.

While the CleanTalk team acted swiftly to patch the issues, website administrators must ensure their sites are updated to the latest version to avoid exploitation. Always prioritize security to protect your website and its users from potential threats.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.