CVE-2024-0842

Executive Summary

CVE-2024-0842 is a high-severity Denial of Service (DoS) vulnerability affecting the Backuply – Backup, Restore, Migrate and Clone plugin for WordPress, up to and including version 1.2.6. The vulnerability allows unauthenticated attackers to directly access the backuply/restore_ins.php file, making excessive requests that can exhaust server resources, leading to a denial of service. This issue is classified under CWE-400 (Uncontrolled Resource Consumption) and is mapped to MITRE ATT&CK tactic T1499 (Endpoint Denial of Service). As a WordPress plugin vulnerability, it specifically impacts the WordPress ecosystem and does not involve Apache or Nginx server software directly. No public proof-of-concept (PoC) code or exploit is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The affected component is the Backuply plugin, which is distributed through the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. Since no patch is available, the supply chain risk is elevated for any site using this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

The threat level is High due to the low attack complexity and the potential for unauthenticated remote attackers to cause a denial of service, impacting the availability of the WordPress site.

Deep Dive & Mechanics

The vulnerability resides in the backuply/restore_ins.php file of the Backuply plugin. This file is intended for internal use during restore operations but is accessible directly via HTTP requests without any authentication checks. An attacker can send a large number of requests to this endpoint, causing the server to allocate excessive resources (CPU, memory, or disk I/O) to handle the requests. This can lead to resource exhaustion, making the WordPress site unresponsive to legitimate users.

The root cause is the lack of proper access controls and rate limiting on the restore_ins.php file. The file likely performs resource-intensive operations (e.g., file extraction, database operations) without verifying the user's identity or limiting the number of concurrent requests.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a hypothetical patch would involve:

• Adding authentication checks (e.g., verifying a nonce or user capability) before executing any operations in restore_ins.php.
• Implementing rate limiting to prevent excessive requests from a single IP address.
• Restricting direct access to the file via .htaccess or WordPress rewrite rules.

Vulnerable Code (hypothetical):

<?php
// backuply/restore_ins.php
// No authentication or rate limiting
include_once('backuply-functions.php');
restore_backup($_POST['backup_file']);
?>

Patched Code (hypothetical):

<?php
// backuply/restore_ins.php
if (!current_user_can('manage_options') || !wp_verify_nonce($_REQUEST['_wpnonce'], 'backuply_restore')) {
    wp_die('Unauthorized');
}
// Rate limiting check
$ip = $_SERVER['REMOTE_ADDR'];
$transient = 'backuply_rate_' . md5($ip);
$count = get_transient($transient);
if ($count === false) {
    set_transient($transient, 1, 60);
} elseif ($count > 10) {
    wp_die('Too many requests');
} else {
    set_transient($transient, $count + 1, 60);
}
include_once('backuply-functions.php');
restore_backup($_POST['backup_file']);
?>

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, the following steps outline a manual exploitation approach:

1. Identify Target: Use Shodan or a web crawler to find WordPress sites running the Backuply plugin (e.g., search for wp-content/plugins/backuply).
2. Craft Requests: Send repeated HTTP GET or POST requests to http://target/wp-content/plugins/backuply/restore_ins.php.
3. Amplify Impact: Use multiple threads or distributed sources to increase the request rate, exhausting server resources.

Example curl command:

for i in {1..1000}; do curl -s -o /dev/null "http://target/wp-content/plugins/backuply/restore_ins.php"; done

Blue Team

To detect and mitigate this vulnerability:

1. Monitor Logs: Look for excessive requests to wp-content/plugins/backuply/restore_ins.php from a single IP or range.
2. Rate Limiting: Implement web application firewall (WAF) rules to limit requests to this endpoint.
3. File Access Control: Use .htaccess to deny direct access to the file:

   <Files "restore_ins.php">
       Order Allow,Deny
       Deny from all
   </Files>
   

4. Disable Plugin: Temporarily deactivate the Backuply plugin until a patch is available.

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/backuply/restore_ins.php
• HTTP Request Pattern: Repeated GET/POST requests to the above path from the same IP or user-agent.
• Server Logs: Entries showing 200 OK responses to restore_ins.php from unauthenticated users.
• Resource Exhaustion: High CPU/memory usage correlated with requests to the plugin directory.

Detection Engineering

YARA Rule

rule CVE_2024_0842_Backuply_DoS {
    meta:
        description = "Detects Backuply plugin restore_ins.php file access"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-0842"
    strings:
        $file_path = "wp-content/plugins/backuply/restore_ins.php"
        $php_tag = "<?php"
    condition:
        $file_path and $php_tag
}

Sigma Rule

title: CVE-2024-0842 Backuply DoS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects excessive requests to Backuply restore_ins.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/wp-content/plugins/backuply/restore_ins.php'
    condition: selection | count() by src_ip > 100 within 60s
falsepositives:
    - Legitimate backup operations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0842 Backuply DoS Attempt"; flow:to_server; content:"/wp-content/plugins/backuply/restore_ins.php"; http_uri; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Deactivate the Backuply plugin until a patched version is released.
2. Workaround: Add the following rule to your .htaccess file to block direct access:

   <IfModule mod_rewrite.c>
       RewriteRule ^wp-content/plugins/backuply/restore_ins\.php - [F,L]
   </IfModule>
   

3. WAF Rules: Create a custom rule in your web application firewall to rate-limit requests to the vulnerable path.
4. Monitor: Continuously monitor server logs for unusual activity targeting the Backuply plugin.
5. Update: Apply the official patch as soon as it becomes available from the plugin vendor.

Valters IT
DevSecOps & Cyber Threat Intelligence