CVE-2024-13567

Executive Summary

CVE-2024-13567 exposes a critical information disclosure vulnerability in the Awesome Support – WordPress HelpDesk & Support Plugin (versions up to and including 6.3.1). The plugin stores sensitive support ticket file attachments in the /wp-content/uploads/awesome-support directory without proper access controls. An unauthenticated attacker can directly enumerate and download these files, leading to exposure of confidential customer data, internal communications, and potentially PII. The vulnerability is partially patched in version 6.3.1, but the vendor has not confirmed a complete fix.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. The insecure storage of uploads in a publicly accessible directory is a common misconfiguration in WordPress plugins that handle file attachments. The attack vector does not involve Apache or Nginx server misconfigurations; it is purely a plugin-level access control failure.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The low complexity and lack of authentication make this an attractive target for mass exploitation. The EPSS score of 0.0% suggests low current exploitation activity, but the public disclosure of the vulnerability increases risk.

Deep Dive & Mechanics

The vulnerability arises from the plugin's failure to restrict access to the /wp-content/uploads/awesome-support/ directory. By default, WordPress allows direct access to files in the uploads directory unless explicitly blocked via .htaccess or server configuration. The Awesome Support plugin stores ticket attachments (e.g., screenshots, documents, logs) in this directory without implementing any authentication or authorization checks.

An attacker can:

1. Enumerate file names by guessing or using directory listing (if enabled).
2. Directly access files via predictable URLs like https://target.com/wp-content/uploads/awesome-support/ticket-1234-attachment.pdf.
3. Use automated tools to scan for common file patterns (e.g., ticket-*.pdf, support-*.zip).

The partial patch in version 6.3.1 may have added some obfuscation or renamed files, but the underlying directory remains accessible. Without a complete fix, attackers can still access files if they know or guess the file names.

Vulnerable vs. Patched Code

Vulnerable Code (pre-6.3.1): The plugin likely stores files with predictable names in the uploads directory without any access control. Example:

// In a vulnerable version, file storage might look like:
$upload_dir = wp_upload_dir();
$file_path = $upload_dir['basedir'] . '/awesome-support/' . $ticket_id . '-' . $file_name;
// No .htaccess or authentication check

Patched Code (6.3.1 partial): The partial patch may have introduced file name randomization or a redirect mechanism, but the directory remains accessible. Example:

// Partial patch might add:
$file_path = $upload_dir['basedir'] . '/awesome-support/' . wp_hash($ticket_id . $file_name) . '-' . $file_name;
// Still no access control on the directory itself

Complete Fix (Unknown): A proper fix would require:

• Moving files outside the web root.
• Implementing a download handler that checks user authentication and authorization.
• Adding .htaccess rules to deny direct access to the directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with Awesome Support plugin <= 6.3.1.
• No directory listing enabled (but file names can be guessed).

Exploitation Steps:

1. Identify the target site and confirm the plugin version.
2. Enumerate ticket IDs (e.g., via support ticket URLs or brute force).
3. Construct file URLs: https://target.com/wp-content/uploads/awesome-support/ticket-{ID}-{filename}.
4. Use a script to download files:

#!/bin/bash
# Simple enumeration script
for ticket_id in {1000..2000}; do
    for ext in pdf docx xlsx zip; do
        url="https://target.com/wp-content/uploads/awesome-support/ticket-${ticket_id}.${ext}"
        wget --spider $url 2>/dev/null && echo "Found: $url"
    done
done

Expected Outcome: Successful extraction of sensitive support ticket attachments.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor access logs for patterns like /wp-content/uploads/awesome-support/ with unusual referrers or user agents.
2. Set up file integrity monitoring on the uploads directory.
3. Implement WAF rules to block direct access to the directory.

Honeypot Setup:

• Create decoy files in the directory with unique names and monitor for access.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/uploads/awesome-support/
• URL Patterns: https://target.com/wp-content/uploads/awesome-support/*
• Log Entries: GET /wp-content/uploads/awesome-support/ with 200 status codes from unknown IPs.
• User Agents: Automated scanning tools (e.g., curl, wget, python-requests).
• File Names: Predictable patterns like ticket-{number}.{ext} or support-{date}.{ext}.

Detection Engineering

YARA Rule

rule CVE_2024_13567_WordPress_Awesome_Support_Info_Disclosure {
    meta:
        description = "Detects attempts to access Awesome Support ticket attachments"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13567"
    strings:
        $url_pattern = /\/wp-content\/uploads\/awesome-support\//
        $file_ext = /\.(pdf|docx|xlsx|zip|txt|png|jpg)$/
    condition:
        $url_pattern and $file_ext
}

Sigma Rule

title: CVE-2024-13567 Awesome Support File Access
id: 8f3c2b1a-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests to the Awesome Support uploads directory
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem|contains: '/wp-content/uploads/awesome-support/'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13567 Awesome Support File Access"; flow:to_server; content:"/wp-content/uploads/awesome-support/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the latest version of Awesome Support (if a complete patch is released).
2. Restrict directory access via .htaccess:

   <Directory /wp-content/uploads/awesome-support/>
       Require all denied
   </Directory>
   

3. Move files outside the web root and use a download handler.

Long-term Fixes:

• Implement proper authentication for file downloads.
• Use non-predictable file names (e.g., UUIDs).
• Regularly audit plugin code for insecure storage.

Workarounds:

• Use a WordPress security plugin to block direct access to the uploads directory.
• Monitor logs for suspicious access patterns.

Report generated by Valters IT DevSecOps Intelligence Unit