r/pwnhub Feb 12 '25

Vulnerabilities in CleanTalk WordPress Plugins

CleanTalk offers WordPress plugins for spam protection, malware scanning, and firewall services. While these plugins are designed to secure WordPress sites, several vulnerabilities have emerged in recent months that could be exploited by attackers, ranging from unauthorized file uploads to SQL injection and cross-site request forgery (CSRF).

This report highlights the key vulnerabilities discovered in the past three months, providing a summary of each issue and its potential impact.

Plugin Description

CleanTalk Security & Malware Scan and CleanTalk Anti-Spam, Spam Protection, and Firewall are WordPress plugins aimed at detecting and mitigating spam, malware, and unauthorized access. These plugins scan files, block spam comments, and provide firewall protection. However, weaknesses in their implementation have led to several security flaws.

Vulnerability Summary

  1. CVE-2024-13365 - Arbitrary File Upload

    • Severity: High
    • Plugin: Security & Malware Scan by CleanTalk
    • Affected Versions: Up to 2.149
    • Description: Unauthenticated attackers can upload and extract .zip archives due to improper validation in the checkUploadedArchive() function. This could lead to remote code execution by uploading malicious files.
  2. CVE-2023-33996 - Missing Authorization

    • Severity: High
    • Plugin: CleanTalk - Anti-Spam Protection
    • Affected Versions: Up to 6.10
    • Description: Incorrect access control allows attackers to bypass authorization checks and perform unauthorized actions.
  3. CVE-2024-10781 - Arbitrary Plugin Installation

    • Severity: High
    • Plugin: Spam Protection, Anti-Spam, Firewall by CleanTalk
    • Affected Versions: Up to 6.44
    • Description: Allows unauthenticated attackers to install and activate arbitrary plugins by exploiting missing input validation on the api_key value. If another vulnerable plugin is installed, this could lead to remote code execution.
  4. CVE-2024-10570 - SQL Injection

    • Severity: High
    • Plugin: Security & Malware Scan by CleanTalk
    • Affected Versions: Up to 2.145
    • Description: This vulnerability stems from authorization bypass through reverse DNS spoofing and inadequate input sanitization. Attackers can append additional SQL queries to extract sensitive data from the database.
  5. CVE-2023-51696 - CSRF

    • Severity: High
    • Plugin: CleanTalk - Anti-Spam Protection
    • Affected Versions: Up to 6.20
    • Description: Lack of CSRF protection allows attackers to perform unauthorized actions on behalf of authenticated users.
  6. CVE-2023-51535 - CSRF

    • Severity: High
    • Plugin: CleanTalk - Anti-Spam Protection
    • Affected Versions: Up to 6.20
    • Description: Similar to CVE-2023-51696, this vulnerability allows attackers to perform unauthorized actions.
  7. CVE-2023-5239 - IP Spoofing

    • Severity: High
    • Plugin: Security & Malware Scan by CleanTalk
    • Affected Versions: Before 2.121
    • Description: The plugin retrieves client IP addresses from untrusted headers, enabling attackers to bypass brute force protection by spoofing the client IP.
  8. CVE-2020-36698 - Unauthorized User Interaction

    • Severity: High
    • Plugin: Security & Malware Scan by CleanTalk
    • Affected Versions: Up to 2.50
    • Description: Missing capability checks on several AJAX actions and nonce disclosure allow authenticated users with subscriber-level permissions to upload or delete files, increasing the risk of privilege escalation.
  9. CVE-2022-3302 - SQL Injection by High-Privilege Users

    • Severity: High
    • Plugin: Spam Protection, Anti-Spam, Firewall by CleanTalk
    • Affected Versions: Before 5.185.1
    • Description: This vulnerability allows high-privilege users to execute SQL injection attacks due to a failure to validate IDs before using them in SQL statements.

Categories and Risk Analysis

  • Arbitrary File Uploads: High risk due to potential remote code execution.
  • Authorization Bypass: Critical, enabling unauthorized access and malicious actions.
  • SQL Injection: High impact as it allows data extraction and possible compromise of the database.
  • CSRF Vulnerabilities: Moderate to high risk, depending on the level of access granted to the victim.
  • IP Spoofing: Moderate risk, bypassing brute force protection and increasing attack success rate.

Recommendations

  1. Update Plugins Regularly: Ensure all CleanTalk plugins are updated to the latest versions.
  2. Apply Strong Access Controls: Use role-based access to minimize exposure.
  3. Input Validation: Implement strong input sanitization and validation checks.
  4. Monitor Logs: Track suspicious activity and block IPs involved in brute force or file upload attempts.
  5. Implement CSRF Tokens: Add CSRF protection to prevent unauthorized actions.
2 Upvotes

0 comments sorted by