The WordPress plug-in Anti-Spam by Cleantalk is used on more than 200,000 WordPress sites. Two critical security vulnerabilities have been discovered in it, which allow attackers from the network to completely compromise vulnerable instances without prior authentication.
Anzeige
Wordfence’s IT security researchers have been notified of an external vulnerability that allows attackers to bypass authorization due to a reverse DNS spoofing vulnerability in Anti-Spam by Cleantalk. This allows unauthenticated attackers to install and activate arbitrary plug-ins on vulnerable WordPress instances and ultimately execute arbitrary code (CVE-2024-10542, CVSS 9.8, risk“critical“). Shortly afterwards, Wordfence analysts discovered a similar vulnerability in the plug-in with the same impact (CVE-2024-10781, CVSS 9.8, critical).
Two similar vulnerabilities
The plug-in can respond to remote calls and perform actions such as installing additional plug-ins. To check whether a call is legitimate, the plug-in checks the reverse-resolved IP address using the strpos() function to see whether “cleantalk.org” appears anywhere in the name. This allows the check to be deactivated with a subdomain: cleantalk.org.boese.domain may call and execute these plug-in functions.
The plug-in authorizes tokens after successfully comparing the hash value with the API key, Wordfence explains the second vulnerability. However, the plug-in code does not prevent authorization if the API key is empty. If the API key has not yet been configured, attackers can authorize themselves by sending a token that corresponds to the empty hash value and can also call the plug-in functions, for example to install additional plug-ins.
Anti-Spam by Cleantalk was affected before the fully corrected version 6.45, which was released in mid-November. Version 6.44 only corrects the first of the two vulnerabilities, the inadequate reverse DNS check. Admins who use the Cleantalk plug-in should check whether they are using the latest version with the bug fixes.
WordPress plug-ins repeatedly jeopardize the security of instances. 200,000 threatened websites with the anti-spam plug-in is already a lot, but other plug-ins with security gaps even reach 4,000,000 installations, such as the Really Simple Security plug-in, in which a critical gap became known around two weeks ago. Even more far-reaching are security gaps in the WordPress plug-in Litespeed Cache – which is in use on around 6,000,000 WordPress instances.
(dmk)
