CVE-2024-13777

Executive Summary

CVE-2024-13777 is a critical PHP Object Injection vulnerability affecting the ZoomSounds - WordPress Wave Audio Player with Playlist plugin for WordPress, up to and including version 6.91. The flaw resides in the deserialization of untrusted input from the margs parameter, allowing unauthenticated attackers to inject arbitrary PHP objects. While the vulnerable plugin itself does not contain a known POP (Property Oriented Programming) chain, the presence of any other plugin or theme with a suitable POP chain on the same WordPress site can lead to severe consequences, including arbitrary file deletion, sensitive data exfiltration, or remote code execution. The CVSS score is 8.1 (High), and no patch is currently available. This vulnerability is particularly dangerous in the WordPress ecosystem due to the common practice of installing multiple plugins, increasing the likelihood of a usable POP chain.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch exists, site administrators must consider the supply chain risk of using this plugin and evaluate alternative audio players. The lack of a POP chain in the plugin itself does not reduce the risk, as the attack surface expands with every additional plugin or theme installed.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The exploit cannot affect other components.
• Confidentiality Impact: High (C:H) – Potential for data exfiltration.
• Integrity Impact: High (I:H) – Potential for file deletion or modification.
• Availability Impact: High (A:H) – Potential for code execution leading to denial of service.

Threat Level: High. The vulnerability is easy to exploit and can lead to full site compromise if a POP chain exists.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection flaw. The margs parameter is passed directly to PHP's unserialize() function without proper sanitization or validation. In PHP, unserialize() reconstructs a serialized object from a string. If an attacker controls the serialized string, they can inject arbitrary PHP objects. The attack becomes dangerous when a "POP chain" exists—a sequence of magic methods (like __wakeup(), __destruct(), __toString(), etc.) in other installed plugins or themes that can be triggered to perform malicious actions.

Key Points:

• Entry Point: The margs parameter in the ZoomSounds plugin.
• Attack Vector: Unauthenticated HTTP request to a vulnerable endpoint.
• Prerequisite: A POP chain must exist in another plugin or theme on the same WordPress installation.
• Impact: Arbitrary file deletion, data theft, or remote code execution.

Example of a POP chain scenario: If another plugin has a class with a __destruct() method that deletes a file based on a property, an attacker can craft a serialized object that sets that property to a sensitive file (e.g., wp-config.php).

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code to a hypothetical secure implementation.

Vulnerable Code (ZoomSounds <= 6.91):

// In some handler file
$margs = $_GET['margs'];
$data = unserialize($margs); // Unsafe deserialization

Patched Code (Hypothetical):

// Secure alternative using JSON
$margs = $_GET['margs'];
$data = json_decode($margs, true); // Safe parsing
if (json_last_error() !== JSON_ERROR_NONE) {
    // Handle error
}

The patched version avoids unserialize() entirely and uses json_decode() which does not instantiate arbitrary objects.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the ZoomSounds plugin (version 6.91 or earlier).
2. Install a plugin with a known POP chain (e.g., a plugin with a __destruct() method that deletes files).
3. Identify the vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=zoomsounds&margs=...).

Exploitation Steps:

1. Craft a serialized PHP object that triggers the POP chain.
2. Send the payload via the margs parameter.
3. Observe the effect (e.g., file deletion, code execution).

Example Payload (for a hypothetical POP chain):

// Assume a class 'FileDeleter' with __destruct() that deletes a file
$payload = new FileDeleter();
$payload->file = '/var/www/html/wp-config.php';
echo serialize($payload);
// Output: O:11:"FileDeleter":1:{s:4:"file";s:30:"/var/www/html/wp-config.php";}

HTTP Request:

GET /wp-admin/admin-ajax.php?action=zoomsounds&margs=O:11:%22FileDeleter%22:1:%7Bs:4:%22file%22%3Bs:30:%22%2Fvar%2Fwww%2Fhtml%2Fwp-config.php%22%3B%7D HTTP/1.1
Host: target.com

Blue Team (Defensive)

Detection:

• Monitor for unusual margs parameters containing serialized PHP objects (e.g., O:, a:, s: patterns).
• Use WAF rules to block requests with unserialize-like patterns.
• Implement file integrity monitoring for critical files.

Mitigation:

• Disable the ZoomSounds plugin until a patch is available.
• Use a Web Application Firewall (WAF) to filter malicious serialized payloads.
• Apply the principle of least privilege to the web server user.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to wp-admin/admin-ajax.php with action=zoomsounds and a margs parameter containing serialized PHP objects (e.g., O:, a:, s:).
  • Unusual outbound connections from the web server (potential C2).
• File System IOCs:
  • Unexpected deletion of files (e.g., wp-config.php, .htaccess).
  • Presence of unknown files in the WordPress directory.
• Log IOCs:
  • PHP error logs showing unserialize() errors or unexpected class instantiation.
  • Web server logs with long, encoded margs parameters.

Detection Engineering

YARA Rule

rule CVE_2024_13777_PHP_Object_Injection {
    meta:
        description = "Detects PHP serialized objects in ZoomSounds margs parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13777"
    strings:
        $serialized = /(O:\d+:"|a:\d+:{|s:\d+:")/
        $margs = "margs=" nocase
    condition:
        $margs and $serialized
}

Sigma Rule

title: ZoomSounds PHP Object Injection Attempt
id: 8f4b3c2a-1e5d-4f7b-9a0c-3d6e8f2b1a4c
status: experimental
description: Detects attempts to exploit CVE-2024-13777 via serialized PHP objects in the margs parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=zoomsounds'
        cs-uri-query|contains: 'margs='
        cs-uri-query|re: '(O:\d+:"|a:\d+:{|s:\d+:")'
    condition: selection
falsepositives:
    - Legitimate use of serialized data (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2024-13777 ZoomSounds PHP Object Injection Attempt";
    flow:to_server;
    content:"action=zoomsounds"; http_uri;
    content:"margs="; http_uri;
    pcre:"/(O:\d+:"|a:\d+:{|s:\d+:")/Ri";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the ZoomSounds plugin until a security patch is released.
2. Review all installed plugins and themes for potential POP chains. Remove any unnecessary plugins.
3. Implement a Web Application Firewall (WAF) with rules to block serialized PHP objects in request parameters.
4. Monitor logs for exploitation attempts.

Long-term Measures:

• Apply the principle of least privilege to the web server user (e.g., www-data).
• Regularly update all WordPress components (core, plugins, themes).
• Use a security plugin that monitors file integrity and detects malicious activity.
• Consider replacing ZoomSounds with a more secure audio player plugin.

Patch Status: No official patch is available. Site administrators should assume the plugin is vulnerable and act accordingly.

Valters IT Signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal. Always obtain proper authorization before testing.