CVE-2024-12331

Executive Summary

CVE-2024-12331 is a medium-severity vulnerability in the Filester WordPress plugin (File Manager Pro). The flaw resides in the ajax_install_plugin function, which lacks a proper capability check. This allows authenticated attackers with Subscriber-level access or higher to install the Filebird plugin without authorization. The vulnerability affects all versions up to and including 1.8.6. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not yet provided a patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Filester plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low EPSS score (0.0%) indicates that exploitation is not currently widespread, but the low attack complexity and low privilege requirement make it a potential risk for WordPress sites with untrusted users.

Deep Dive & Mechanics

The vulnerability exists in the ajax_install_plugin function within the Filester plugin. This function is intended to allow administrators to install plugins via AJAX. However, it fails to verify that the requesting user has the necessary capabilities (e.g., install_plugins or activate_plugins). As a result, any authenticated user, including Subscribers, can trigger the installation of the Filebird plugin.

The function likely uses current_user_can() incorrectly or not at all. The missing capability check allows an attacker to send a crafted AJAX request to install the Filebird plugin, which could then be used for further exploitation (e.g., file uploads, privilege escalation).

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.8.6):

add_action('wp_ajax_install_plugin', 'ajax_install_plugin');
function ajax_install_plugin() {
    // No capability check
    $plugin_slug = $_POST['plugin_slug'];
    // Install plugin logic...
}

Patched Code (Hypothetical):

add_action('wp_ajax_install_plugin', 'ajax_install_plugin');
function ajax_install_plugin() {
    if (!current_user_can('install_plugins')) {
        wp_die('Unauthorized');
    }
    $plugin_slug = sanitize_text_field($_POST['plugin_slug']);
    // Install plugin logic...
}

The patch would add a capability check using current_user_can('install_plugins') and sanitize the input.

Exploitation & Lab Setup

Red Team

1. Prerequisites: Authenticated WordPress session with Subscriber-level access.
2. Exploit Steps:
   • Log in as a Subscriber.
   • Send a POST request to /wp-admin/admin-ajax.php with the following parameters:
     • action: install_plugin
     • plugin_slug: filebird
   • The Filebird plugin will be installed automatically.
3. Post-Exploitation: Use Filebird's features (e.g., file upload, directory traversal) to escalate privileges or exfiltrate data.

Example cURL command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=install_plugin&plugin_slug=filebird" \
  --cookie "wordpress_logged_in_xxx=..."

Blue Team

1. Detection: Monitor AJAX requests to admin-ajax.php with action=install_plugin from non-admin users.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block such requests from low-privilege users.
3. Honeypot: Create a fake endpoint to log unauthorized installation attempts.

Indicators of Compromise (IOCs)

• File Changes: Presence of the Filebird plugin in /wp-content/plugins/filebird/.
• Log Entries: WordPress debug log entries showing AJAX requests with action=install_plugin from Subscriber users.
• Network Traffic: POST requests to /wp-admin/admin-ajax.php with plugin_slug=filebird.
• Database: New entry in wp_options for active_plugins containing filebird.

Detection Engineering

YARA Rule

rule CVE_2024_12331_WordPress_Filester {
    meta:
        description = "Detects exploitation attempts for CVE-2024-12331 in Filester plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12331"
    strings:
        $ajax_action = "install_plugin"
        $plugin_slug = "filebird"
        $wp_ajax = "wp_ajax_install_plugin"
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-12331 Filester Plugin Unauthorized Plugin Installation
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a9e8c
status: experimental
description: Detects AJAX requests to install Filebird plugin via Filester vulnerability
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "admin-ajax.php"
        cs-uri-query|contains: "action=install_plugin"
        cs-uri-query|contains: "plugin_slug=filebird"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12331 Filester Plugin Unauthorized Plugin Installation"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=install_plugin"; http_client_body; content:"plugin_slug=filebird"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Filester plugin until a patch is available.
   • Remove the Filebird plugin if it was installed unexpectedly.
   • Review user roles and remove Subscriber accounts that are not needed.

2. Long-term Fix:

   • Apply the vendor patch when released.
   • Implement capability checks in custom plugins.

3. Workarounds:

   • Use a WAF to block AJAX requests with action=install_plugin from non-admin users.
   • Add a custom function to functions.php to restrict the AJAX action:

     add_action('wp_ajax_install_plugin', function() {
         if (!current_user_can('install_plugins')) {
             wp_die('Unauthorized');
         }
     }, 0);
     

4. Monitoring:

   • Enable WordPress debug logging to track suspicious AJAX requests.
   • Regularly audit installed plugins and user capabilities.

Valters IT
Securing Digital Frontiers