WordPress CleanTalk 플러그인 인증 우회 취약점 (CVE-2024-10542, CVE-2024-10781)

1. CleanTalk 플러그인 [1]

- 워드프레스 웹사이트에서 스팸을 방지하기 위해 사용되는 플러그인
- 스팸 방지 기능을 제공하는 클라우드 기반 서비스

2. 주요내용 [2]

2.1 CVE-2024-10542

[사진 1] CVE-2024-10542 [3]

- WordPress CleanTalk 플러그인에서 발생하는 DNS 스푸핑을 통한 인증 우회 취약점 (CVSS: 9.8)
> 악용에 성공할 경우 인증되지 않은 공격자가 임의의 플러그인을 설치 및 활성화하여 원격 코드를 실행할 수 있음

영향받는 버전
- Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2

 

- 아래 함수는 토큰을 저장된 API 비교 또는 checkWithoutToken()를 통해 토큰 없이도 작업을 수행할 수 있는지 확인

78 |  // Check Access key
79 | if (
80 |     ($token === strtolower(md5($apbct->api_key)) ||
81 |      $token === strtolower(hash('sha256', $apbct->api_key))) ||
82 |    self::checkWithoutToken()
83 | ) {
84 |     // Flag to let plugin know that Remote Call is running.
85 |     $apbct->rc_running = true;
86 |  
87 |   $action = 'action__' . $action;
88 | 
89 |   if ( method_exists(__CLASS__, $action) ) {

 

- checkWithoutToken()는 발신 IP가 cleantalk.org 에 속하는지 확인
> IP는 사용자 정의 매개 변수인 X-Central-Ip 및 X-Forward-By 헤더 매개 변수로 결정되므로, IP 스푸핑에 취약
> IP 확인 후 strpos()를 사용해 도메인 이름을 확인하는데, 도메인에 'cleantalk.org' 문자열이 포함된 경우 검사를 통과할 수 있어, DNS 스푸핑에 취약

34 | public static function checkWithoutToken()
35 | {
36 |    global $apbct;
37 | 
38 |    $is_noc_request = ! $apbct->key_is_ok &&
39 |        Request::get('spbc_remote_call_action') &&
40 |        in_array(Request::get('plugin_name'), array('antispam', 'anti-spam', 'apbct')) &&
41 |        strpos(Helper::ipResolve(Helper::ipGet()), 'cleantalk.org') !== false;

 

2.2 CVE-2024-10781

[사진 2] CVE-2024-10781 [4]

- WordPress CleanTalk 플러그인에서 ‘api_key’ 값 검증 누락으로 인해 발생하는 인증 우회 취약점 (CVSS: 8.1)
> 악용에 성공할 경우 인증되지 않은 공격자가 임의의 플러그인을 설치 및 활성화할 수 있음

영향받는 버전
- Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.44

 

- API 키와 해시를 비교하여 토큰을 인증하는 방법이 존재
> 그러나 해당 함수에 API 키가 비어 있을 때 인증을 방지하기 위한 검증이 없음
> API 키가 플러그인에 구성되어 있지 않으면 비어 있는 해시 값과 일치하는 토큰을 사용해 인증을 우회할 수 있음

76 | $token  = strtolower(Request::get('spbc_remote_call_token'));
...
93 | // Check Access key
94 | if (
95 |    ($token === strtolower(md5($apbct->api_key)) ||
96 |     $token === strtolower(hash('sha256', $apbct->api_key))) ||
97 |    (self::checkWithoutToken() && self::isAllowedWithoutToken($action))
98 | ) {

3. 대응방안

- 벤더사 제공 업데이트 적용 [5][6]

> 두 취약점이 모두 해결된 6.45 버전으로 업데이트 권고

제품명	취약점	영향받는 버전	해결 버전
Spam protection, Anti-Spam, FireWall by CleanTalk	CVE-2024-10542	<= 6.43.2	6.44
	CVE-2024-10781	<= 6.44	6.45

4. 참고

[1] https://cleantalk.org/
[2] https://www.wordfence.com/blog/2024/11/200000-wordpress-sites-affected-by-unauthenticated-critical-vulnerabilities-in-anti-spam-by-cleantalk-wordpress-plugin/
[3] https://nvd.nist.gov/vuln/detail/CVE-2024-10542
[4] https://nvd.nist.gov/vuln/detail/CVE-2024-10781
[5] https://wordpress.org/plugins/cleantalk-spam-protect/#developers
[6] https://asec.ahnlab.com/ko/84781/
[7] https://thehackernews.com/2024/11/critical-wordpress-anti-spam-plugin.html
[8] https://www.securityweek.com/critical-vulnerabilities-found-in-anti-spam-plugin-used-by-200000-wordpress-sites/
[9] https://www.boannews.com/media/view.asp?idx=134689&page=2&kind=1