CVE-2024-12159

Executive Summary

CVE-2024-12159 is a medium-severity information disclosure vulnerability affecting the Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords WordPress plugin, versions up to and including 3.1. The vulnerability exists because the file print_php_information.php is publicly accessible without any authentication. This allows any unauthenticated attacker to retrieve sensitive configuration data from the server, including database credentials, file paths, and other environment variables exposed by phpinfo(). While the CVSS score is 5.3 (Medium), the exposed information can be leveraged to facilitate more severe attacks, such as SQL injection or remote code execution, if combined with other vulnerabilities.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are not running modified or malicious versions. The lack of a patch from the vendor increases the risk of supply chain attacks if the plugin is bundled with other themes or plugins.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Only configuration data is exposed.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the direct impact is limited to information disclosure, the exposed data can be used to pivot to more critical attacks.

Deep Dive & Mechanics

The vulnerability is caused by the presence of the file print_php_information.php in the plugin directory. This file typically contains a call to phpinfo(), which outputs a comprehensive summary of the PHP configuration, including:

• Server environment variables (e.g., $_SERVER, $_ENV)
• Database credentials (if stored in environment variables)
• File paths and document root
• Loaded PHP extensions and their versions
• Server software and version (e.g., Apache, Nginx)
• Configuration directives (e.g., allow_url_fopen, disable_functions)

The file is accessible via a direct URL like:

https://target.com/wp-content/plugins/optimize-your-campaigns/print_php_information.php

No authentication or nonce is required, making it trivial for attackers to retrieve this data. The information can be used to:

• Identify vulnerable software versions for targeted exploits.
• Extract database credentials for direct database access.
• Discover file paths for local file inclusion (LFI) attacks.
• Bypass security controls by understanding the server configuration.

Vulnerable vs. Patched Code

Vulnerable Code (print_php_information.php):

<?php
phpinfo();
?>

Patched Code (Hypothetical): The vendor should either remove the file entirely or restrict access to authenticated users with administrative privileges. A patched version might include:

<?php
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( 'Unauthorized access.' );
}
phpinfo();
?>

Since no official patch is available, users must manually remove or secure the file.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Reconnaissance: Identify WordPress sites using the vulnerable plugin. Use Shodan dorks or Google dorks like inurl:/wp-content/plugins/optimize-your-campaigns/print_php_information.php.

2. Exploitation: Access the file directly:

   curl -s http://target.com/wp-content/plugins/optimize-your-campaigns/print_php_information.php
   

3. Data Extraction: Parse the output for sensitive information. For example, extract database credentials:

   curl -s http://target.com/wp-content/plugins/optimize-your-campaigns/print_php_information.php | grep -i "DB_USER\|DB_PASSWORD\|DB_NAME"
   

4. Pivoting: Use the extracted credentials to access the database or perform further attacks.

Blue Team (Defense)

1. Detection: Monitor web server logs for requests to print_php_information.php. Example log entry:

   192.168.1.100 - - [12/Dec/2024:10:00:00 +0000] "GET /wp-content/plugins/optimize-your-campaigns/print_php_information.php HTTP/1.1" 200 12345 "-" "Mozilla/5.0"
   

2. Mitigation: Remove or rename the file immediately:

   rm wp-content/plugins/optimize-your-campaigns/print_php_information.php
   

   Or restrict access via .htaccess:

   <Files "print_php_information.php">
       Require all denied
   </Files>
   

3. Honeypot: Create a fake print_php_information.php that logs access and alerts administrators.

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/optimize-your-campaigns/print_php_information.php
• URL Pattern: */wp-content/plugins/optimize-your-campaigns/print_php_information.php
• HTTP Response: Status 200 with text/html content containing phpinfo() output.
• Log Entry: GET request to the above path from an unauthenticated source.

Detection Engineering

YARA Rule

rule detect_cve_2024_12159_phpinfo {
    meta:
        description = "Detects requests to the vulnerable print_php_information.php file"
        author = "Valters IT"
        date = "2024-12-12"
        reference = "CVE-2024-12159"
    strings:
        $phpinfo = "phpinfo()"
        $filepath = "print_php_information.php"
    condition:
        $phpinfo and $filepath
}

Sigma Rule

title: CVE-2024-12159 - Information Disclosure via print_php_information.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to the vulnerable print_php_information.php file in WordPress
author: Valters IT
date: 2024-12-12
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/wp-content/plugins/optimize-your-campaigns/print_php_information.php'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12159 - WordPress Optimize Your Campaigns Information Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/optimize-your-campaigns/print_php_information.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove or rename the print_php_information.php file from the plugin directory.
2. Access Control: If the file is required for debugging, restrict access to authenticated administrators using .htaccess or WordPress capabilities.
3. Update Plugin: Monitor the WordPress plugin repository for an official patch. If none is provided, consider replacing the plugin with an alternative.
4. Web Application Firewall (WAF): Block requests to the vulnerable path using a WAF rule.
5. Security Audit: Review the entire plugin for other potential vulnerabilities, as the presence of this file suggests poor security practices.

Valters IT – Securing your digital assets with precision.