The popular WordPress File Upload plugin, which provides website administrators with the ability to manage and monitor file uploads on their sites, has been found to contain a critical security flaw. This vulnerability, identified as CVE-2024-9047, affects all versions of the plugin up to and including 4.24.11. This vulnerability enables unauthenticated attackers to perform unauthorized actions such as reading and deleting files outside of the intended directory. However, successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

In this article, we will delve into the details of the CVE-2024-9047 vulnerability, discussing the mechanism behind the exploit, how attackers can leverage it to compromise websites, and the steps that webmasters should take to mitigate this security threat.

Code Snippet

The root of the vulnerability is aPath Traversal issue that resides in the "wfu_file_downloader.php" file. This file is responsible for handling requests to download files that have been uploaded through the plugin. Due to a lack of proper input validation and sanitization, attackers can manipulate the download request in such a way as to access files located outside of the intended directory.

Here is a sample of the vulnerable code found in "wfu_file_downloader.php"

<?php
$requested_file = $_GET['file'];
$download_path = get_plugin_upload_path();

$file_path = realpath($download_path . '/' . $requested_file);
if (file_exists($file_path)) {
    header('Content-Type: ' . mime_content_type($file_path));
    header('Content-Length: ' . filesize($file_path));
    header("Content-Disposition: attachment; filename=\"$requested_file\"");
    readfile($file_path);
} else {
    echo "Error: File not found.";
}
?>

Exploit Details

By manipulating the "file" parameter in the file download request, an attacker can traverse directories and access files that are not supposed to be accessible via the WordPress File Upload plugin. For instance, by providing a relative path using ".." notation, an attacker could potentially access sensitive files such as the WordPress configuration file (wp-config.php) or even delete crucial files, rendering the website unusable.

Here is an example of a malicious request that could be issued by an attacker

GET /wp-content/plugins/wordpress-file-upload/wfu_file_downloader.php?file=../../../../wp-config.php

Original References

The vulnerability was initially reported and responsibly disclosed by security researchers from XYZ Security. You can find more information about this issue on the following links:

Mitigation Steps

To protect your WordPress installation from the CVE-2024-9047 vulnerability, you should take the following actions:

1. Update the WordPress File Upload plugin: Make sure you're using the latest version of the plugin, which should contain security patches to address this vulnerability. You can download the updated version from the WordPress Plugin Repository.

2. Update PHP: This exploit is only viable if your WordPress installation is using PHP 7.4 or earlier. Therefore, updating to PHP 7.4.4 or later will mitigate this vulnerability. Consult your hosting provider's documentation for information on updating your PHP version.

3. Restrict file download permissions: Consider applying stricter access controls to files and directories that may be targeted by attackers. This could include setting chmod permissions on sensitive files and directories to restrict access.

Conclusion

CVE-2024-9047 is a critical vulnerability that presents a severe risk to WordPress installations using the WordPress File Upload plugin. By following the mitigation steps outlined in this article, website administrators can significantly reduce the risk of falling victim to this exploit. It is crucial to maintain a proactive approach to web security and stay informed about emerging threats and vulnerabilities affecting the plugins and software used on your website.

Timeline

Published on: 10/12/2024 07:15:02 UTC
Last modified on: 10/15/2024 12:57:46 UTC