ThriveDesk <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Cache Deletion

This research plan outlines the steps required to demonstrate the missing authorization vulnerability in the ThriveDesk plugin, allowing a Subscriber-level user to clear the plugin's cache.

1. Vulnerability Summary

The ThriveDesk plugin for WordPress (versions <= 2.1.7) fails to perform a capability check (e.g., current_user_can( 'manage_options' )) in the handler for the thrivedesk_clear_cache AJAX action. While the plugin may implement nonce verification, the nonce is often exposed to all authenticated users in the WordPress admin dashboard (e.g., via script localization on the profile.php page). Consequently, any authenticated user with at least Subscriber-level permissions can trigger the cache deletion functionality.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: thrivedesk_clear_cache
• Method: POST
• Parameters:
  • action: thrivedesk_clear_cache
  • _nonce or nonce (inferred): The security token for the request.
• Required Authentication: Subscriber-level account (PR:L).
• Preconditions: The plugin must be active and the Subscriber user must be able to access the WordPress backend (standard for WordPress sites unless explicitly disabled).

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX action during initialization:
   add_action( 'wp_ajax_thrivedesk_clear_cache', 'thrivedesk_clear_cache_handler' );
2. Trigger: An authenticated user sends a POST request to admin-ajax.php with action=thrivedesk_clear_cache.
3. Vulnerable Handler: The handler function (likely thrivedesk_clear_cache_handler) is called. It may check a nonce using check_ajax_referer or wp_verify_nonce, but it fails to check if the user has administrative privileges.
4. Sink: The handler calls the internal clearing function (e.g., clearing transients or database options) and returns a success response.

4. Nonce Acquisition Strategy

Because the source files provided are primarily CSS and bundled JS, the exact nonce variable name must be identified dynamically. Most WordPress plugins localize their data into a global window object.

1. Identify the variable: Search for where ThriveDesk localizes its script data.
   • Command: grep -rn "wp_localize_script" . in the plugin directory.
   • Expected identifiers: Look for td_nonce, thrivedesk, or thrivedesk_admin_options.
2. Acquisition Flow:
   • Log in as a Subscriber.
   • Navigate to /wp-admin/profile.php.
   • Use browser_eval to find the ThriveDesk object and its nonce.
   • Probable JS Path: window.thrivedesk?.nonce or window.td_admin?.nonce.

5. Exploitation Strategy

1. Preparation:
   • Log in as a Subscriber using the http_request or browser_navigate tool.
2. Nonce Extraction:
   • Navigate to the WordPress dashboard (Subscriber view).
   • Execute JS to find the nonce:

     // Example search for the nonce in the window object
     Object.keys(window).find(key => key.includes('thrivedesk'));
     

3. Execution:
   • Construct a POST request to admin-ajax.php.
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Body (URL-encoded):
     • action=thrivedesk_clear_cache
     • _ajax_nonce=[EXTRACTED_NONCE] (Note: The parameter name might be nonce, _nonce, or td_nonce).
4. Capture Response:
   • Verify the HTTP status is 200.
   • Look for a success indicator in the body: {"success":true} or 1.

6. Test Data Setup

1. Plugin Installation: Install and activate the ThriveDesk plugin (version 2.1.7).
2. User Creation: Create a user with the subscriber role.
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Cache Generation: Ensure some plugin data is cached (e.g., by visiting ThriveDesk settings as an admin or interacting with the plugin if it caches API responses).

7. Expected Results

• The Subscriber's request to thrivedesk_clear_cache should be accepted.
• The server response should indicate success (e.g., JSON {"success":true}).
• The plugin's cache/transients should be removed.

8. Verification Steps

1. Manual Check: Before running the exploit, check if specific ThriveDesk transients exist in the database.
   • wp transient list --search="thrivedesk*"
2. Post-Exploit Check: After the Subscriber request, verify the transients are gone.
   • wp transient list --search="thrivedesk*"
3. Response Analysis: Confirm the response was not a 403 Forbidden or a 0 (which typically indicates a failed AJAX registration or auth failure in WordPress).

9. Alternative Approaches

• REST API: Check if a similar endpoint exists via the REST API (referencing assets/js/wp-scripts/thrivedesk-autonami-tab.js which uses wp-api-fetch).
  • Check for routes like thrivedesk/v1/cache/clear.
• Nonce-less Attempt: If the grep search for check_ajax_referer in the plugin's PHP files returns no results, try the request without a nonce parameter to confirm if verification is missing entirely.