CVE-2024-11600

Executive Summary

CVE-2024-11600 is a critical Remote Code Execution (RCE) vulnerability affecting the Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg WordPress plugin, versions up to and including 1.6.0. The flaw resides in the write_config function, which fails to sanitize an imported JSON file. This allows an authenticated attacker with Administrator-level privileges to execute arbitrary code on the underlying server. The vulnerability is classified as a deserialization or unsafe object instantiation issue (CWE-502), where untrusted JSON data is processed without proper validation. Given the high privileges required (Admin), the CVSS score is 7.2 (High). No public proof-of-concept or patch is currently available, making this a high-priority zero-day for affected WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Administrators should verify the integrity of the plugin package and ensure no unauthorized modifications have been made. The lack of a patch from the vendor (Borderless) means that supply chain risk is elevated, as no official fix exists to prevent exploitation.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond network access.
• Privileges Required (PR): High (H) – Administrator-level access is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary code execution allows data modification.
• Availability (A): High (H) – Code execution can disrupt services.

Threat Level: High. While the attack requires admin credentials, the impact is total server compromise. The lack of a patch and public exploit increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is triggered via the write_config function within the Borderless plugin. This function is designed to import configuration settings from a JSON file. The flaw lies in the lack of sanitization or validation of the JSON content before it is processed. An attacker can craft a malicious JSON payload that, when processed, leads to arbitrary code execution. This is typical of insecure deserialization (CWE-502) where the application instantiates objects or executes code based on attacker-controlled data.

The attack flow:

1. An authenticated administrator navigates to the plugin's settings page.
2. The attacker uploads or provides a malicious JSON file via the import functionality.
3. The write_config function reads the JSON without sanitization.
4. The malicious payload triggers code execution, e.g., by instantiating a PHP object that executes system commands.

The exact mechanism depends on how the JSON is processed. If the plugin uses json_decode and then directly uses the resulting array/object in a dangerous function (like eval, call_user_func, or unserialize), the attacker can inject arbitrary PHP code.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable function likely resembles:

// Vulnerable code (conceptual)
function write_config($json_data) {
    $config = json_decode($json_data, true);
    // No sanitization - directly uses $config
    foreach ($config as $key => $value) {
        update_option($key, $value);
    }
}

A patched version would include input validation and sanitization:

// Patched code (conceptual)
function write_config($json_data) {
    $config = json_decode($json_data, true);
    if (json_last_error() !== JSON_ERROR_NONE) {
        wp_die('Invalid JSON');
    }
    // Whitelist allowed keys and sanitize values
    $allowed_keys = ['setting1', 'setting2'];
    foreach ($config as $key => $value) {
        if (in_array($key, $allowed_keys)) {
            update_option($key, sanitize_text_field($value));
        }
    }
}

The key difference is the addition of a whitelist and sanitization functions to prevent arbitrary data from being processed.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials (username/password).
• Target site running Borderless plugin <= 1.6.0.

Exploitation Steps:

1. Authenticate to WordPress and navigate to the Borderless settings page (typically /wp-admin/admin.php?page=borderless-settings).

2. Craft a malicious JSON payload that triggers code execution. For example, if the plugin uses eval or unserialize, the payload might look like:

{
    "template": "<?php system($_GET['cmd']); ?>"
}

Or, if it uses object instantiation:

{
    "class": "WP_Error",
    "args": ["<?php system('id'); ?>"]
}

3. Upload the JSON file via the import functionality. The plugin will process it and execute the injected code.

4. Verify execution by accessing a generated file or triggering the injected code (e.g., via a web request to a created PHP file).

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install Borderless plugin version 1.6.0.
• Create an admin user.
• Use Burp Suite or cURL to intercept and modify the JSON import request.

Blue Team (Detection & Defense)

Detection:

• Monitor for admin users uploading JSON files to the Borderless settings page.
• Look for unusual PHP file creation in the WordPress uploads or plugin directories.
• Detect outbound connections from the web server to unknown IPs after plugin import.

Defense:

• Immediately restrict admin access to only trusted users.
• Disable the Borderless plugin until a patch is available.
• Implement Web Application Firewall (WAF) rules to block suspicious JSON payloads.
• Enable file integrity monitoring (e.g., OSSEC) to detect new PHP files.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected PHP files in /wp-content/uploads/ or /wp-content/plugins/borderless/.
  • Modified .htaccess files.
• Network:
  • Outbound connections to unknown IPs from the web server.
  • Unusual POST requests to /wp-admin/admin-ajax.php with JSON payloads.
• Logs:
  • WordPress debug log entries showing eval() or unserialize() calls.
  • Web server access logs showing requests to /wp-admin/admin.php?page=borderless-settings followed by file creation.

Detection Engineering

YARA Rule

rule CVE_2024_11600_Borderless_RCE {
    meta:
        description = "Detects malicious JSON payloads targeting CVE-2024-11600 in Borderless plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11600"
    strings:
        $json_payload = /\{[^}]*"template"[^}]*system\(/
        $php_code = /<\?php\s*(system|exec|shell_exec|passthru|eval)\(/
    condition:
        $json_payload or $php_code
}

Sigma Rule

title: CVE-2024-11600 Borderless Plugin RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2024-11600 via malicious JSON uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin.php*'
        cs-uri-query: 'page=borderless-settings'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate plugin configuration changes
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-11600 Borderless Plugin RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=borderless-settings"; http_uri; content:"json"; http_client_body; pcre:"/\{.*\"template\".*system\(/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Borderless plugin until a patch is released.
2. Review admin accounts and remove any unnecessary privileged users.
3. Check for signs of compromise using the IOCs above.

Long-term Fix:

• Monitor the plugin vendor's website for a patched version (>= 1.6.1).
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative if no patch is forthcoming.

Workaround:

• Implement a Web Application Firewall (WAF) rule to block JSON uploads to the Borderless settings page.
• Restrict access to the plugin settings page via .htaccess or IP whitelisting.

Valters IT