CVE-2024-2346

Executive Summary

CVE-2024-2346 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the FileBird – WordPress Media Library Folders & File Manager plugin, versions up to and including 5.6.3. This vulnerability allows authenticated attackers with Author-level access or higher to delete folders created by other users. The root cause is missing validation on a user-controlled key during folder deletion, enabling unauthorized deletion of arbitrary folders. This can lead to disruption of file organization and potential exposure of file uploads from other users. The vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's update channel for a patched version. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires Author-level or higher authentication
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential exposure of file uploads
• Integrity Impact: Low (I:L) – unauthorized folder deletion
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires authentication but is trivial to execute once authenticated.

Deep Dive & Mechanics

The vulnerability resides in the folder deletion functionality of the FileBird plugin. The plugin uses a user-controlled key (likely a folder ID or nonce) to identify which folder to delete. Due to missing validation, an attacker can manipulate this key to delete folders owned by other users. The plugin does not verify that the authenticated user owns the folder before deletion.

Attack Flow:

1. Attacker authenticates with Author-level or higher privileges.
2. Attacker sends a crafted request to the folder deletion endpoint, specifying a folder ID belonging to another user.
3. The plugin processes the deletion without verifying ownership.
4. The folder is deleted, and any file uploads associated with that folder become visible to other users (due to WordPress's default behavior of making orphaned files public).

Root Cause: Missing authorization check on the folder_id parameter in the deletion handler.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the plugin's AJAX handler for folder deletion. A simplified example:

Vulnerable Code (PHP):

add_action('wp_ajax_filebird_delete_folder', 'filebird_delete_folder');
function filebird_delete_folder() {
    $folder_id = intval($_POST['folder_id']);
    // No ownership check
    $wpdb->delete($wpdb->prefix . 'fbv', array('id' => $folder_id));
    wp_die();
}

Patched Code (PHP):

add_action('wp_ajax_filebird_delete_folder', 'filebird_delete_folder');
function filebird_delete_folder() {
    $folder_id = intval($_POST['folder_id']);
    $user_id = get_current_user_id();
    // Verify ownership
    $folder = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}fbv WHERE id = %d AND created_by = %d", $folder_id, $user_id));
    if (!$folder) {
        wp_die('Unauthorized');
    }
    $wpdb->delete($wpdb->prefix . 'fbv', array('id' => $folder_id));
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with FileBird plugin <= 5.6.3
• Valid user account with Author-level or higher privileges
• Knowledge of another user's folder ID (can be enumerated)

Exploitation Steps:

1. Log in to WordPress as an Author.
2. Identify a target folder ID (e.g., via directory listing or brute-force).
3. Send a POST request to /wp-admin/admin-ajax.php with:
   • action: filebird_delete_folder
   • folder_id: [target_folder_id]
4. The folder is deleted, and its files become publicly visible.

Example cURL Command:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=filebird_delete_folder&folder_id=42" \
  --cookie "wordpress_logged_in_xxx=..."

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action=filebird_delete_folder.
• Alert on rapid deletion requests from a single user.
• Log folder deletion events with user ID and folder ID.

Hunting:

• Search for filebird_delete_folder in web server logs.
• Correlate deletion events with user privilege levels (Author+).
• Check for orphaned media files (files without folder association).

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=filebird_delete_folder and varying folder_id values.
• File System: Deletion of rows from wp_fbv table (WordPress database).
• Logs: Apache/Nginx access logs showing repeated AJAX calls to admin-ajax.php with action=filebird_delete_folder.
• Behavior: Sudden disappearance of folders and orphaned media files.

Detection Engineering

YARA Rule

rule Detect_FileBird_IDOR_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-2346 in FileBird plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2346"
    strings:
        $ajax_action = "filebird_delete_folder"
        $folder_id = "folder_id"
    condition:
        all of them
}

Sigma Rule

title: FileBird IDOR Folder Deletion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation of CVE-2024-2346 via AJAX request
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=filebird_delete_folder'
    condition: selection
falsepositives:
    - Legitimate folder deletion by folder owner
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2346 FileBird IDOR Folder Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=filebird_delete_folder"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version of FileBird (>= 5.6.4 if available). If not, disable the plugin until a patch is released.
2. Restrict User Roles: Limit Author-level users to only their own folders via custom code or additional plugins.
3. Web Application Firewall (WAF): Block requests to admin-ajax.php with action=filebird_delete_folder from non-admin users.

Long-term Fix:

• Implement proper authorization checks in the plugin's folder deletion handler.
• Use nonces and capability checks to ensure only folder owners can delete their folders.

Workaround:

• Manually patch the plugin by adding ownership verification in the filebird_delete_folder function.

Valters IT – DevSecOps & Cyber Threat Intelligence