CVE-2024-13906

Executive Summary

CVE-2024-13906 is a critical PHP Object Injection vulnerability affecting the Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin, versions up to and including 4.7.3. The flaw resides in the import_gallery_from_csv function, which deserializes untrusted input without proper sanitization. An authenticated attacker with Administrator-level privileges can inject arbitrary PHP objects. While the vulnerable plugin itself does not contain a known POP (Property Oriented Programming) chain, the presence of any other plugin or theme with a suitable POP chain on the same WordPress site can lead to severe consequences, including arbitrary file deletion, sensitive data exfiltration, or remote code execution. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the potential impact is high due to the privilege level required and the dependency on additional components.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. It does not affect Apache, Nginx, or the WordPress core itself. The attack surface is limited to sites running the vulnerable plugin with Administrator-level users.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – Administrator-level access is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Potential data exfiltration.
• Integrity Impact: High (I:H) – Potential file modification or code execution.
• Availability Impact: High (A:H) – Potential file deletion or service disruption.

Threat Level: High. While the EPSS score is low, the potential for severe impact when combined with other plugins makes this a significant risk for WordPress sites with Administrator accounts.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection flaw, categorized under CWE-502 (Deserialization of Untrusted Data). The import_gallery_from_csv function in the plugin processes CSV files uploaded by administrators. The function likely uses PHP's unserialize() or a similar function on data extracted from the CSV without proper validation.

How it works:

1. An authenticated Administrator uploads a malicious CSV file via the plugin's import functionality.
2. The plugin reads the CSV and deserializes a portion of the data (e.g., a serialized PHP object embedded in a cell).
3. If a POP chain exists in another installed plugin or theme, the deserialized object triggers a chain of magic methods (e.g., __wakeup(), __destruct(), __toString()) that lead to arbitrary actions.

Why it's dangerous:

• Privilege Escalation: Although Administrator access is required, a compromised admin account or a malicious insider can exploit this.
• Dependency on POP Chain: The vulnerability itself is a "gadget" that requires a separate POP chain to be useful. Common POP chains exist in plugins like WooCommerce, Advanced Custom Fields, or even WordPress core itself in some cases.
• No Known Exploit: As of now, no public exploit code or POP chain has been disclosed, but the vulnerability is real and can be weaponized.

Vulnerable vs. Patched Code

Since no official patch has been released, the vulnerable code remains in version 4.7.3 and earlier. The patched version would need to replace unserialize() with a safe alternative like json_decode() or implement strict input validation.

Vulnerable Code (Conceptual):

function import_gallery_from_csv($file) {
    $data = file_get_contents($file);
    $rows = array_map('str_getcsv', explode("\n", $data));
    foreach ($rows as $row) {
        // Vulnerable: deserializing untrusted input
        $gallery_data = unserialize($row[2]); // Assuming column 2 contains serialized data
        // Process $gallery_data...
    }
}

Patched Code (Conceptual):

function import_gallery_from_csv($file) {
    $data = file_get_contents($file);
    $rows = array_map('str_getcsv', explode("\n", $data));
    foreach ($rows as $row) {
        // Safe: using JSON instead of serialization
        $gallery_data = json_decode($row[2], true);
        if (json_last_error() !== JSON_ERROR_NONE) {
            // Handle error or reject the input
            continue;
        }
        // Process $gallery_data...
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the vulnerable plugin (version <= 4.7.3) installed.
• Administrator credentials.
• A separate plugin or theme with a known POP chain (e.g., WooCommerce, ACF, or a custom gadget).

Steps:

1. Identify a POP Chain: Use tools like phpggc to generate a gadget chain for a known vulnerable plugin on the target site.
2. Craft Malicious CSV: Create a CSV file where one column contains the serialized POP chain object.

   title,description,gallery_data
   My Gallery,Test,"O:10:\"MyGadget\":1:{s:5:\"shell\";s:10:\"id\";}"
   

3. Upload CSV: Log in as Administrator, navigate to the plugin's import page, and upload the CSV.
4. Trigger Deserialization: The plugin processes the CSV and deserializes the malicious object, executing the POP chain.
5. Achieve Impact: Depending on the POP chain, you can read files, execute commands, or delete files.

Example POP Chain (using phpggc for WooCommerce):

phpggc -i 10 WooCommerce/RCE1 system 'id'

This generates a serialized payload that, when deserialized, executes system('id').

Blue Team (Detection & Prevention)

Detection:

• Monitor for CSV file uploads to the plugin's import endpoint.
• Look for unusual serialized data patterns in HTTP requests (e.g., O:, a:, s:).
• Use WAF rules to block serialized PHP objects in uploads.

Prevention:

• Restrict Administrator access to only trusted users.
• Disable the CSV import feature if not needed.
• Apply input validation and use json_decode() instead of unserialize().
• Keep all plugins and themes updated to avoid POP chains.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /wp-content/uploads/ or /tmp/ (e.g., shell.php, backdoor.php).
  • Modified .htaccess or wp-config.php files.
• Network:
  • Outbound connections to unknown IPs or domains (e.g., C2 servers).
  • Unusual HTTP requests to /wp-admin/admin-ajax.php or plugin import endpoints.
• Logs:
  • PHP error logs showing unserialize() errors or __wakeup() calls.
  • WordPress debug logs with unexpected object instantiation.
• Processes:
  • Unexpected PHP processes running with high privileges.

Detection Engineering

YARA Rule

rule CVE_2024_13906_PHP_Object_Injection {
    meta:
        description = "Detects serialized PHP objects in CSV uploads for CVE-2024-13906"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13906"
    strings:
        $serialized = /[Oa]:\d+:/
        $csv_header = /title,description,gallery_data/
    condition:
        $csv_header and $serialized
}

Sigma Rule

title: CVE-2024-13906 - PHP Object Injection via CSV Import
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit PHP Object Injection in Gallery by BestWebSoft plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=import_gallery_from_csv'
    condition: selection
falsepositives:
    - Legitimate CSV imports by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-13906 - PHP Object Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=import_gallery_from_csv"; http_client_body; pcre:"/[Oa]:\d+:/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: If the CSV import feature is not critical, deactivate and delete the plugin.
2. Restrict Administrator Access: Limit the number of users with Administrator privileges and enforce strong passwords.
3. Monitor Logs: Review access logs for suspicious CSV uploads.

Long-term Fix:

• Apply Patch: Once the vendor releases a patch, update the plugin immediately.
• Code Hardening: Replace unserialize() with json_decode() in the plugin code.
• Use a WAF: Deploy a Web Application Firewall with rules to block serialized PHP objects.

Workaround:

• If the plugin must be used, manually edit the vulnerable function to use json_decode() instead of unserialize().

Valters IT
Securing Digital Frontiers