CVE-2024-1076

Executive Summary

CVE-2024-1076 is a vulnerability in the SSL Zen WordPress plugin (versions before 4.6.0) that exposes the site's generated private keys due to improper directory listing prevention. The plugin relies solely on .htaccess files to block access to the private keys folder. However, .htaccess is an Apache-specific feature; on servers like NGINX (which do not process .htaccess), the directory is fully accessible, allowing any unauthenticated attacker to list and download the private SSL/TLS keys. This is a WordPress ecosystem issue, not a server misconfiguration. The vulnerability has a CVSS score of 7.5 (High) due to the confidentiality impact of exposed private keys.

Supply Chain & Package Security

This vulnerability affects the SSL Zen WordPress plugin, distributed via the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or manually are at risk. No known supply chain compromise has been reported, but the plugin's reliance on .htaccess for security is a design flaw.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (private keys exposed)
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. An attacker can retrieve the site's private SSL/TLS keys, enabling decryption of HTTPS traffic, impersonation of the site, and man-in-the-middle attacks.

Deep Dive & Mechanics

The SSL Zen plugin generates and stores private SSL/TLS keys in a directory (typically /wp-content/uploads/ssl-zen/ or similar). To prevent unauthorized access, the plugin places an .htaccess file in that directory with Deny from all directives. This works on Apache servers, which honor .htaccess files. However, on NGINX (and other non-Apache servers), .htaccess files are ignored. As a result, the directory is browsable and its contents (including private keys) are accessible to anyone who knows the path.

The vulnerability is rooted in the plugin's assumption that .htaccess is a universal security mechanism. The fix in version 4.6.0 likely implements server-agnostic access controls, such as PHP-based authentication or a .php file that checks permissions before serving the keys.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.6.0): The plugin creates an .htaccess file in the private keys directory:

Deny from all

This file is placed in the directory, but NGINX ignores it.

Patched Code (4.6.0+): The plugin likely uses a PHP wrapper or a .php file that validates requests before serving the keys. For example:

<?php
// ssl-zen-keys.php
if (!current_user_can('manage_options')) {
    wp_die('Unauthorized');
}
// Serve the key file
?>

Or the plugin may use .htaccess combined with a server check, or move the keys outside the web root.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site running SSL Zen < 4.6.0 on an NGINX server.
• Knowledge of the private keys directory path (default: /wp-content/uploads/ssl-zen/).

Exploitation Steps:

1. Identify the target WordPress site and confirm it uses NGINX (e.g., via HTTP headers or server fingerprinting).
2. Access the private keys directory:

   https://target.com/wp-content/uploads/ssl-zen/
   

3. If directory listing is enabled, you will see the private key files (e.g., private.key, certificate.crt).
4. Download the private key file:

   wget https://target.com/wp-content/uploads/ssl-zen/private.key
   

5. Use the private key to decrypt HTTPS traffic or impersonate the site.

Example cURL command:

curl -O https://target.com/wp-content/uploads/ssl-zen/private.key

Blue Team

Detection:

• Monitor access logs for requests to /wp-content/uploads/ssl-zen/ or similar paths.
• Alert on any download of .key or .pem files from the uploads directory.

Honeypot:

• Place a fake private.key file in the directory and monitor for access.

Lab Setup:

1. Install WordPress on an NGINX server.
2. Install SSL Zen plugin version 4.5.9.
3. Generate a certificate using the plugin.
4. Verify the vulnerability by accessing the keys directory.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/ssl-zen/
  • /wp-content/uploads/ssl-zen/private.key
  • /wp-content/uploads/ssl-zen/certificate.crt
• Network Requests:
  • GET requests to /wp-content/uploads/ssl-zen/ with a 200 OK response.
  • User-Agent strings typical of wget, curl, or automated scanners.
• Log Entries:
  • Access logs showing directory listing of the ssl-zen folder.
  • Error logs showing attempts to access .htaccess files (though NGINX will return 404).

Detection Engineering

YARA Rule

rule CVE_2024_1076_SSL_Zen_Private_Key_Exposure {
    meta:
        description = "Detects access to SSL Zen private keys directory"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1076"
    strings:
        $key_path = "/wp-content/uploads/ssl-zen/"
        $key_file = /private\.key|certificate\.crt/
    condition:
        $key_path and $key_file
}

Sigma Rule

title: CVE-2024-1076 SSL Zen Private Key Exposure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to SSL Zen private keys directory
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-1076
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/wp-content/uploads/ssl-zen/'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1076 SSL Zen Private Key Exposure"; flow:to_server; content:"GET"; http_method; content:"/wp-content/uploads/ssl-zen/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SSL Zen to version 4.6.0 or later.
2. If upgrade is not possible, manually protect the keys directory:
   • For NGINX: Add a location block to deny access:

     location /wp-content/uploads/ssl-zen/ {
         deny all;
         return 403;
     }
     

   • For Apache: Ensure .htaccess is enabled and the file is present.
3. Revoke and regenerate any exposed private keys immediately.
4. Rotate all certificates that used the exposed keys.

Long-term Mitigation:

• Implement server-agnostic access controls (e.g., PHP authentication).
• Store sensitive files outside the web root.
• Regularly audit WordPress plugins for security best practices.

Valters IT
Securing digital landscapes, one CVE at a time.