CVE-2024-30221

Executive Summary

CVE-2024-30221 is a Deserialization of Untrusted Data vulnerability in the Sunshine Photo Cart WordPress plugin (versions <= 3.1.1). This flaw allows an unauthenticated attacker to inject and execute arbitrary PHP objects via malicious serialized data, potentially leading to remote code execution, data manipulation, or privilege escalation. The vulnerability resides in the plugin's handling of user-supplied serialized input without proper validation or sanitization. As of this report, no official patch is available, and the vendor's patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant due to the potential for full site compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors leveraging this flaw in targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited data modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the potential for chaining with other vulnerabilities or achieving remote code execution via gadget chains elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection via insecure deserialization. The sunshine-photo-cart plugin likely uses PHP's unserialize() function on user-controlled input (e.g., from cookies, POST data, or request parameters) without proper validation. When an attacker supplies a crafted serialized object, PHP will instantiate arbitrary classes and call their magic methods (e.g., __wakeup(), __destruct(), __toString()). If a suitable gadget chain exists within the WordPress core or installed plugins/themes, this can lead to remote code execution.

Key Mechanics:

1. Entry Point: The plugin accepts serialized data via a parameter (e.g., option, data, or a cookie).
2. Deserialization: The plugin calls unserialize() on the input without sanitization.
3. Gadget Chain: An attacker crafts a serialized payload that triggers a chain of magic methods, ultimately executing arbitrary PHP code.
4. Impact: Full site compromise, data theft, or malware injection.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable code in sunshine-photo-cart
$data = $_POST['some_data'];
$obj = unserialize($data); // No validation

A patched version would use json_decode() or validate the serialized data:

// Patched code (hypothetical)
$data = $_POST['some_data'];
if (is_serialized($data)) {
    $obj = unserialize($data, ['allowed_classes' => false]); // Restrict classes
} else {
    $obj = json_decode($data);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with Sunshine Photo Cart <= 3.1.1 installed.
• Knowledge of a suitable PHP gadget chain (e.g., using WordPress core classes like WP_HTML_Token or Requests_Transport_cURL).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., via source code review or fuzzing).
2. Generate a serialized payload using a tool like phpggc:

   phpggc WordPress/RCE1 system 'id' | base64
   

3. Send the payload to the vulnerable endpoint:

   curl -X POST http://target/wp-admin/admin-ajax.php \
        -d 'action=some_action&data=<base64_encoded_payload>'
   

4. Verify execution via out-of-band (OOB) or error-based detection.

Example Payload (Base64 encoded):

TzoxNjoiV1BfSFRNTF9Ub2tlbiI6Mjp7czo0OiJ0b2tlbiI7czo2OiJzeXN0ZW0iO3M6NToibmFtZXMiO2E6MTp7aTowO3M6MjoiaWQiO319

Blue Team

Detection Steps:

1. Monitor for unusual serialized data in HTTP requests (e.g., O:, a:, s: patterns).
2. Enable PHP error logging to catch deserialization errors.
3. Use WAF rules to block serialized payloads in non-essential parameters.
4. Regularly scan for known gadget chains using YARA rules.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing serialized PHP objects (e.g., O:, C:, a:).
• File System: Unexpected PHP files in wp-content/uploads/ or wp-content/plugins/.
• Logs: PHP errors like unserialize(): Error at offset or Class __PHP_Incomplete_Class.
• Process: Unusual system commands executed via exec(), system(), or shell_exec().

Detection Engineering

YARA Rule

rule CVE_2024_30221_Deserialization {
    meta:
        description = "Detects serialized PHP objects in HTTP requests targeting Sunshine Photo Cart"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-30221"
    strings:
        $serialized = /(O:\d+:"|a:\d+:{|s:\d+:"|C:\d+:")/
        $plugin_path = /sunshine-photo-cart/
    condition:
        $serialized and $plugin_path
}

Sigma Rule

title: CVE-2024-30221 - Sunshine Photo Cart Deserialization Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing serialized PHP objects targeting Sunshine Photo Cart
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: 'sunshine-photo-cart'
        http.body|contains|all:
            - 'O:'
            - 'a:'
            - 's:'
    condition: selection
falsepositives:
    - Legitimate plugin functionality using serialization
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-30221 - Sunshine Photo Cart Deserialization Attempt"; flow:to_server; content:"sunshine-photo-cart"; http_uri; pcre:"/(O:\d+:"|a:\d+:{|s:\d+:")/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block serialized payloads in POST/GET parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor must replace unserialize() with json_decode() or use unserialize() with ['allowed_classes' => false].
• Apply input validation and sanitization to all user-supplied data.

Workaround:

• Use a PHP ini directive to disable unserialize of arbitrary classes:

  unserialize_callback_func = null
  

Valters IT
Securing Digital Frontiers