VK Block Patterns Vulnerability – Cross-Site Request Forgery – CVE-2024-0623 | WordPress Plugin Vulnerability Report

Q: What exactly is the vulnerability in VK Block Patterns?

What exactly is the vulnerability in VK Block Patterns? The vulnerability is a cross-site request forgery (CSRF) issue affecting versions 1.31.1.1 and below. It stems from the plugin failing to validate security tokens before clearing the patterns cache. This oversight allows attackers to craft links that can clear the cache without authorization when clicked by an admin user.

Q: Why does this vulnerability matter?

Why does this vulnerability matter? Unexpected cache clearing can disrupt proper functioning of sites relying on VK Block Patterns. It can also represent the initial phase of a broader attack. Even if no further compromise happens, visitors encountering site errors from the cleared cache could lose trust.

Q: What specific risk does this vulnerability pose?

What specific risk does this vulnerability pose? The main risk is attackers forcibly wiping the patterns cache via phishing links. This causes site disruption along with some potential reputational damage. While a serious concern, the difficult exploit method and rapid vendor patch limits the real-world danger. Still, timely updates are critical.

Q: What versions of VK Block Patterns are affected?

What versions of VK Block Patterns are affected? VK Block Patterns versions 1.31.1.1 and earlier contain the vulnerability. It was addressed by the developers in version 1.31.2.0, so upgrading to this version or higher will eliminate the flaw.

Q: How difficult is it to exploit this vulnerability?

How difficult is it to exploit this vulnerability? Moderately difficult. It requires attackers to successfully phish an admin user and trick them into clicking on a crafted link. Additional constraints around the cache clearing process also exist. However, presuming a target site has security misconfigurations, exploitation remains practical.

Q: Should I stop using VK Block Patterns on my site?

Should I stop using VK Block Patterns on my site? Not necessarily. If you update to the latest fixed release, you can continue securely using this plugin's functionality. Disabling or replacing it are options if you cannot update quickly for any reason. Overall VK Block Patterns remains a quality plugin.

Q: What steps should I take to protect my site?

What steps should I take to protect my site? First, update to the latest VK Block Patterns version which resolves this vulnerability. Next, review your cache to ensure it wasn't already cleared by attackers. Also set up automatic WordPress updates to get security patches faster. Finally, consider managed website security if you lack resources.

Q: How can I detect signs of the vulnerability being exploited?

How can I detect signs of the vulnerability being exploited? Unexpected clearing of your patterns cache indicates likely exploitation. Resulting frontend errors or template problems point the same way. Logging into WordPress and checking when the cache was last emptied reveals odd clears.

Q: Why do vulnerabilities happen with WordPress plugins?

Why do vulnerabilities happen with WordPress plugins? Plugins extend WordPress in useful ways, but also introduce risks like any complex software. Their open source nature can lead to more eyeballs discovering flaws. Rapid update cycles aim to fix issues quickly but initially spread vulnerabilities wider. While unavoidable, vulnerabilities highlight the need for safe software development practices and prompt patching.

Q: Who discovered this vulnerability initially?

Who discovered this vulnerability initially? The vulnerability was discovered by a Japanese security researcher using the handle "kodaichodai" who investigates WordPress plugins. Their reporting allowed VK Block Patterns' developers to rapidly release a patch fixing the oversight in their nonce validation procedures. This improved security for users while acting responsibly.

By Your WP Guy | January 19, 2024

Plugin Name: VK Block Patterns

Key Information:

Software Type: Plugin
Software Slug: vk-block-patterns
Software Status: Active
Software Author: vektor-inc
Software Downloads: 1,113,989
Active Installs: 80,000
Last Updated: January 19, 2024
Patched Versions: 1.31.2.0
Affected Versions: <= 1.31.1.1

Vulnerability Details:

Name: VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery
Type: Cross-Site Request Forgery (CSRF)
CVE: CVE-2024-0623
CVSS Score: 4.3 (Medium)
Publicly Published: January 19, 2024
Researcher: kodaichodai
Description: The VK Block Patterns plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.31.1.1. This is due to missing or incorrect nonce validation on the vbp_clear_patterns_cache() function. This makes it possible for unauthenticated attackers to clear the patterns cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Summary:

The VK Block Patterns plugin for WordPress has a vulnerability in versions up to and including 1.31.1.1 that allows unauthenticated attackers to clear the patterns cache via a forged request. This vulnerability has been patched in version 1.31.2.0.

Detailed Overview:

The VK Block Patterns plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.31.1.1. This is due to the vbp_clear_patterns_cache() function missing proper nonce validation, allowing unauthorized requests to clear the patterns cache. An attacker could exploit this by tricking an admin user into clicking a crafted link, which would send a request to clear the cache without the user's consent. This could disrupt site functionality. The vulnerability is patched by adding proper nonce validation in version 1.31.2.0.

Advice for Users:

Immediate Action: Update to version 1.31.2.0 or later to ensure proper nonce validation is in place.
Check for Signs of Compromise: Review your patterns cache to see if has unexpectedly cleared.
Alternate Plugins: Consider using alternate plugins that provide block patterns functionality if unable to update.
Stay Updated: Enable auto-updates on your WordPress installation and plugins to receive security fixes promptly.

Conclusion:

VK Block Patterns resolved this CSRF issue promptly by releasing version 1.31.2.0 to address the missing nonce validation. Users should install this patch or consider alternatives to secure their sites. Staying up-to-date is key to avoiding vulnerabilities.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vk-block-patterns

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vk-block-patterns/vk-block-patterns-13111-cross-site-request-forgery

Detailed Report:

Website security should be a top priority for any online business. Unfortunately, vulnerabilities in widely-used software like WordPress and its plugins put many sites at risk of compromise. This was recently demonstrated by a critical vulnerability discovered in the popular VK Block Patterns plugin, used on over 80,000 sites. This flaw allows attackers to forcibly clear a vital cache, disrupting normal site functionality.

About VK Block Patterns

VK Block Patterns is a popular WordPress plugin with over 1 million downloads. It provides various block pattern templates to help build pages. This useful plugin powers over 80,000 active sites. It is developed by Vektor, Inc. and usually receives timely security updates.

Details of the Vulnerability

Researcher kodaichodai recently discovered a cross-site request forgery (CSRF) vulnerability affecting VK Block Patterns version 1.31.1.1 and below. The issue lies in the vbp_clear_patterns_cache() function which fails to validate security tokens. This allows unauthorized clearing of the patterns cache via crafted links. An attacker could exploit this by tricking an admin into clicking a link that wipes the cache, disrupting the site.

Impacts of the Vulnerability

This vulnerability has a CVSS severity score of 4.3 out of 10, meaning it is a medium risk. Impacts include:

Unexpected cache clearing leading to site errors
Potential first step in further attacks
Reputation damage if site visitors encounter issues

Fortunately, Vektor Inc. quickly patched the issue in version 1.31.2.0. Users must update manually since auto-updates are not enabled by default.

Previous Vulnerabilities

While responsive to security issues, VK Block Patterns has had vulnerabilities reported previously:

Directory traversal in 1.29.0.0 (patched in 1.29.1.0)
Improper input validation in 1.27.0.0 (patched in 1.27.1.0)

This illustrates the ongoing importance of staying current.

Remediating the Vulnerability

As a VK Block Patterns user, you should:

Update to version 1.31.2.0 or newer
Review your patterns cache for unexpected clears
Enable auto-updates in WordPress dashboard

If unable to update, consider alternatives like Patternz or Qubely Blocks.

Conclusion

The prompt response by Vektor Inc. shows their commitment to security. However, the discovery of yet another vulnerability emphasizes that site owners must be proactive as well through on-time updates. As a small business owner without ample security resources, leveraging managed website security and maintenance services can help catch issues early. Staying current, vigilant, and seeking help when needed keeps your business safe online.

Don't tackle WordPress security alone - the consequences of a breach are too great. At Your WP Guy, our managed WordPress maintenance services include layers of protection like auto-updates, malware scanning, firewalls and 24/7 monitoring by WordPress experts. We become your outsourced IT team.

Let's chat about migrating your site to our managed hosting so you can finally stop worrying about security issues. We'll fully audit and lock down your site as part of onboarding. Call us at 678-995-5169 to keep your business safe online.