CVE-2024-2294

Executive Summary

CVE-2024-2294 is a directory traversal vulnerability in the Backuply – Backup, Restore, Migrate and Clone plugin for WordPress, affecting all versions up to and including 1.2.7. The flaw resides in the backuply_download_backup function, where the backup_name parameter is not properly sanitized, allowing an authenticated attacker with only the activate_plugins capability to read arbitrary files on the server. This vulnerability is specifically exploitable on Windows-based hosting environments due to the use of backslashes in path traversal sequences. The CVSS score is 4.9 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation at this time. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. Since no patch is available, the supply chain risk is elevated for sites using this plugin on Windows servers.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (requires activate_plugins capability)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for authenticated access, but the potential for high confidentiality impact (exposure of sensitive files) on Windows servers makes it a significant risk for affected environments.

Deep Dive & Mechanics

The vulnerability exists in the backuply_download_backup function within the Backuply plugin. This function is responsible for handling backup file downloads. The backup_name parameter is passed directly to file operations without proper sanitization or validation. On Windows servers, directory traversal sequences such as ..\ can be used to navigate outside the intended backup directory.

The attack flow:

1. An attacker with activate_plugins capability (typically a WordPress administrator or a user with elevated plugin management rights) crafts a malicious request to the download endpoint.
2. The backup_name parameter is set to a path traversal string, e.g., ..\..\wp-config.php.
3. The plugin's function reads the file from the server's filesystem and serves it to the attacker.
4. Sensitive information such as database credentials, API keys, or configuration files can be exfiltrated.

The vulnerability is Windows-specific because the path separator \ is used, whereas Linux servers use / and are not affected by this particular traversal method.

Vulnerable vs. Patched Code

Vulnerable Code (Backuply <= 1.2.7):

function backuply_download_backup() {
    $backup_name = $_GET['backup_name'];
    $file_path = BACKUPLY_BACKUP_DIR . $backup_name;
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
        readfile($file_path);
    }
}

Patched Code (Hypothetical):

function backuply_download_backup() {
    $backup_name = basename($_GET['backup_name']); // Remove path components
    $file_path = BACKUPLY_BACKUP_DIR . $backup_name;
    // Additional validation: ensure file is within allowed directory
    $real_path = realpath($file_path);
    $allowed_dir = realpath(BACKUPLY_BACKUP_DIR);
    if (strpos($real_path, $allowed_dir) !== 0) {
        wp_die('Invalid file path.');
    }
    if (file_exists($file_path)) {
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
        readfile($file_path);
    }
}

The patched version uses basename() to strip directory traversal sequences and validates that the resolved path is within the allowed backup directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress installation with Backuply plugin version <= 1.2.7
• Windows server hosting
• Valid user account with activate_plugins capability

Exploitation Steps:

1. Obtain a valid session cookie for a user with activate_plugins capability.
2. Craft a request to download a sensitive file:

   GET /wp-admin/admin-ajax.php?action=backuply_download_backup&backup_name=..\..\wp-config.php HTTP/1.1
   Host: target-site.com
   Cookie: wordpress_logged_in_xxx=...
   

3. The server will respond with the contents of wp-config.php, revealing database credentials and other secrets.

Lab Setup:

• Use a local Windows environment with XAMPP or WAMP.
• Install WordPress and the Backuply plugin.
• Create a user with activate_plugins capability.
• Use Burp Suite or cURL to send the malicious request.

Blue Team

Detection:

• Monitor for unusual file download requests to admin-ajax.php with action=backuply_download_backup.
• Look for backup_name parameters containing ..\ or other path traversal patterns.
• Alert on access to sensitive files like wp-config.php, .htaccess, or php.ini via the plugin.

Hunting:

• Search web server logs for requests containing backuply_download_backup and ..\.
• Review access logs for Windows path separators in query strings.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=backuply_download_backup and backup_name containing ..\
  • Outbound data transfers containing wp-config.php or other sensitive file contents

• File System IOCs:

  • Unauthorized access to files outside the backup directory (e.g., wp-config.php, php.ini)
  • Modified file access timestamps on sensitive files

• Log IOCs:

  • Web server logs showing 200 OK responses to backuply_download_backup with path traversal patterns
  • WordPress debug logs indicating file read errors from unexpected paths

Detection Engineering

YARA Rule

rule Detect_Backuply_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against Backuply plugin CVE-2024-2294"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2294"
    strings:
        $traversal1 = "..\\" ascii wide
        $traversal2 = "backuply_download_backup" ascii wide
        $sensitive = "wp-config.php" ascii wide
    condition:
        $traversal2 and ($traversal1 or $sensitive)
}

Sigma Rule

title: Backuply Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-2294 in Backuply plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=backuply_download_backup'
        cs-uri-query|contains: '..\\'
    condition: selection
falsepositives:
    - Legitimate backup downloads with similar naming
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2294 Backuply Directory Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=backuply_download_backup"; http_uri;
    content:"..\\"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Backuply plugin on Windows servers until a patch is available.
2. Restrict the activate_plugins capability to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block requests containing ..\ in the backup_name parameter.

Long-term Fix:

• Apply the official patch from the plugin vendor when released.
• Upgrade to a patched version (monitor the WordPress plugin repository for updates).
• Consider migrating to an alternative backup plugin that is actively maintained.

Compensating Controls:

• Use file integrity monitoring to detect unauthorized access to sensitive files.
• Enable detailed logging for WordPress admin-ajax.php requests.
• Implement network segmentation to limit exposure of Windows-based WordPress installations.

Report generated by Valters IT DevSecOps & CTI Division