CVE-2024-2871

Executive Summary

CVE-2024-2871 is a critical SQL Injection vulnerability discovered in the Media Library Assistant plugin for WordPress, affecting all versions up to and including 3.13. This flaw resides in the plugin's shortcode handling, specifically within the mla_gallery shortcode. Due to insufficient input escaping and lack of proper SQL query preparation, authenticated attackers with at least Contributor-level access can inject arbitrary SQL commands into existing database queries. Successful exploitation allows the attacker to extract sensitive information from the WordPress database, including user credentials, password hashes, and other confidential data. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released. Given the widespread use of this plugin and the low complexity of exploitation, this vulnerability poses a significant risk to WordPress sites.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress ecosystem and the Media Library Assistant plugin. It is not related to the underlying web server (Apache or Nginx) but rather to insecure coding practices within the plugin's shortcode processing logic.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): Low – An attacker needs a valid WordPress account with Contributor-level access or higher.
• User Interaction (UI): None – The attack does not require any action from another user.
• Scope (S): Unchanged – The exploitation does not affect other components beyond the vulnerable plugin.
• Confidentiality Impact (C): High – Successful exploitation can lead to full database disclosure.
• Integrity Impact (I): Low – Limited ability to modify data.
• Availability Impact (A): Low – Limited ability to disrupt service.

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration and the authenticated nature of the attack make it a serious concern for any WordPress site using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the mla_gallery shortcode, which is used to display media items. The plugin fails to properly sanitize user-supplied parameters before incorporating them into SQL queries. Specifically, the post__in and post__not_in parameters, which accept comma-separated lists of post IDs, are not adequately escaped. This allows an attacker to inject SQL keywords and operators.

Attack Flow:

1. An authenticated user with Contributor-level access creates or edits a post/page.
2. The attacker inserts the mla_gallery shortcode with a malicious parameter, e.g., [mla_gallery post__in="1 UNION SELECT user_login,user_pass FROM wp_users--"].
3. When the shortcode is processed, the plugin constructs an SQL query using the unsanitized input.
4. The injected SQL is appended to the existing query, allowing the attacker to retrieve data from other tables.
5. The result is displayed within the gallery output, leaking sensitive information.

Root Cause: The plugin uses addslashes() or similar weak escaping instead of parameterized queries (prepared statements). This is a classic SQL injection pattern.

Vulnerable vs. Patched Code

Vulnerable Code (Version 3.13 and earlier):

// In class-mla-shortcodes.php
$post__in = isset($atts['post__in']) ? $atts['post__in'] : '';
$post__in = addslashes($post__in); // Insufficient escaping
$query = "SELECT * FROM {$wpdb->posts} WHERE ID IN ({$post__in})";

Patched Code (Hypothetical fix):

// Patched version
$post__in = isset($atts['post__in']) ? $atts['post__in'] : '';
$post__in_array = array_map('intval', explode(',', $post__in)); // Sanitize each element
$placeholders = implode(',', array_fill(0, count($post__in_array), '%d'));
$query = $wpdb->prepare("SELECT * FROM {$wpdb->posts} WHERE ID IN ({$placeholders})", $post__in_array);

The patched code uses intval() to ensure each ID is an integer and then uses $wpdb->prepare() for parameterized queries, which prevents SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with the Media Library Assistant plugin (version <= 3.13) installed and activated.
• A valid user account with Contributor-level privileges or higher.

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Create a new post or page.
3. Insert the following shortcode into the content:

   [mla_gallery post__in="1 UNION SELECT user_login,user_pass FROM wp_users--"]
   

4. Publish or preview the post.
5. The gallery output will display the usernames and password hashes from the wp_users table.

Advanced Payloads:

• Extract all user data: 1 UNION SELECT user_login,user_email,user_pass FROM wp_users--
• Extract options table: 1 UNION SELECT option_name,option_value FROM wp_options--
• Time-based blind injection: 1 AND SLEEP(5)--

Note: No public exploit code is available at this time. The above is a conceptual demonstration.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for unusual shortcode parameters containing SQL keywords (UNION, SELECT, FROM, etc.).
• Use a Web Application Firewall (WAF) to block requests with suspicious post__in or post__not_in values.
• Implement database query monitoring to detect unexpected SQL statements.

Response:

• Immediately disable the Media Library Assistant plugin if exploitation is suspected.
• Review user accounts for unauthorized Contributor-level access.
• Rotate all user passwords and API keys.
• Conduct a forensic analysis of database logs to determine the extent of data exfiltration.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing mla_gallery shortcode with SQL keywords in the post__in or post__not_in parameters.
• Example: POST /wp-admin/post.php with body containing [mla_gallery post__in="1 UNION SELECT..."]

File IOCs:

• Modified posts/pages containing malicious shortcodes.
• Suspicious entries in the wp_posts table with post_content containing SQL injection patterns.

Log IOCs:

• Database error logs showing syntax errors near UNION or SELECT.
• Web server access logs with unusual query strings.

Detection Engineering

YARA Rule

rule CVE_2024_2871_WordPress_MLA_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-2871 in Media Library Assistant plugin"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-2871"
    strings:
        $shortcode = /\[mla_gallery[^\]]*post__in\s*=\s*["'][^"']*UNION/i
        $sql_keywords = /UNION|SELECT|FROM|WHERE|SLEEP|BENCHMARK/i
    condition:
        $shortcode and any of ($sql_keywords)
}

Sigma Rule

title: CVE-2024-2871 WordPress Media Library Assistant SQL Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts via mla_gallery shortcode
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mla_gallery'
        cs-uri-query|contains|all:
            - 'post__in'
            - 'UNION'
    condition: selection
falsepositives:
    - Legitimate use of UNION in shortcode parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2871 WordPress Media Library Assistant SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"mla_gallery"; http_client_body;
    content:"post__in"; http_client_body;
    content:"UNION"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Restrict Contributor-level access to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Long-term Fix:

• The vendor must release a patched version that uses parameterized queries ($wpdb->prepare()) and proper input validation.
• Until then, consider using an alternative media library plugin.

Workaround:

• Add the following code to the theme's functions.php to block malicious shortcode parameters:

add_filter('shortcode_atts_mla_gallery', function($out, $pairs, $atts) {
    if (isset($atts['post__in']) && preg_match('/UNION|SELECT|FROM/i', $atts['post__in'])) {
        wp_die('SQL injection attempt detected.');
    }
    return $out;
}, 10, 3);

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.