CVE-2024-1813·PHP vulnerability

Affected versions

How to fix this CVE

The Simple Job Board WordPress plugin contains a critical PHP object injection vulnerability in versions up to 2.11.0 that allows unauthenticated attackers to inject malicious PHP objects during job application processing. Immediately upgrade the plugin to version 2.11.1 or later, which patches the unsafe deserialization in the job_board_applicant_list_columns_value function. Additionally, audit your WordPress environment for any complementary plugins or themes that may provide exploitable POP chains, and consider implementing input validation and object integrity checks at the application level.

sudo dnf upgrade php php-common php-cli

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST requests to wp-admin/admin-ajax.php or job application endpoints containing serialized PHP objects matching pattern O:[0-9]+:"[a-zA-Z_]+":[0-9]+:{

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to block HTTP requests containing PHP serialized object syntax (pattern: O:[0-9]+:) in POST parameters, specifically targeting job application submission endpoints and AJAX handlers. Additionally, restrict deserialization in job application processing to only explicit, whitelisted object types.

How to check if you are affected

1. Verify the installed PHP version: php --version
2. Check the Simple Job Board plugin version via WordPress admin panel (Plugins > Installed Plugins) or via SSH: grep 'Version:' /path/to/wp-content/plugins/simple-job-board/simple-job-board.php
3. Search application logs for suspicious serialized object patterns in POST requests to job application endpoints: grep -i 'O:[0-9]\+:' /var/log/apache2/access.log /var/log/nginx/access.log
4. Verify the patched version is installed: grep 'Version:' /path/to/wp-content/plugins/simple-job-board/simple-job-board.php | grep -E '2\.1[1-9]|2\.[2-9]|[3-9]\.[0-9]'

FAQ

Related PHP CVEs

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/89584034-4a93-42a6-8fef-55dc3895c45c?source=cve