CVE-2024-3034

Executive Summary

CVE-2024-3034 is a directory traversal vulnerability in the BackUpWordPress plugin for WordPress, affecting all versions up to and including 3.13. The flaw exists in the hmbkp_directory_browse parameter, allowing authenticated attackers with administrator-level access to traverse directories outside the intended scope. This could lead to unauthorized disclosure of sensitive files on the server, such as configuration files, logs, or other WordPress assets. The vulnerability has a low CVSS score of 2.7 due to the high privileges required (admin) and the limited impact (confidentiality only). No public proof-of-concept or exploit code is currently available, and the vendor has not released a patch.

CVSS Breakdown & Threat Level

• CVSS Score: 2.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. Exploitation requires administrator credentials, significantly reducing the attack surface. However, in shared hosting or multi-tenant WordPress environments, a compromised admin account could leverage this to read sensitive files outside the web root.

Deep Dive & Mechanics

The vulnerability resides in the hmbkp_directory_browse parameter used by the BackUpWordPress plugin for directory navigation during backup configuration. The plugin fails to properly sanitize or validate user-supplied input, allowing path traversal sequences (e.g., ../) to escape the intended backup directory.

Root Cause: The plugin does not restrict the hmbkp_directory_browse parameter to a predefined safe path. An attacker can supply a value like ../../../../etc/passwd to read arbitrary files on the server.

Attack Flow:

1. Authenticate as an administrator.
2. Send a crafted request to the plugin's AJAX handler with the hmbkp_directory_browse parameter containing path traversal sequences.
3. The plugin returns the contents of the traversed directory or file, leaking sensitive information.

Impact: An attacker could read WordPress configuration files (wp-config.php), server configuration, or other sensitive data, potentially leading to further compromise.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's directory browsing function. A patched version would implement strict input validation and path canonicalization.

Vulnerable Code (Conceptual):

$path = $_POST['hmbkp_directory_browse'];
$contents = scandir($path); // No sanitization

Patched Code (Conceptual):

$base = '/var/www/html/wp-content/backups/';
$path = realpath($base . '/' . $_POST['hmbkp_directory_browse']);
if (strpos($path, $base) !== 0) {
    die('Invalid path');
}
$contents = scandir($path);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials.
• BackUpWordPress plugin version <= 3.13 installed and active.

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Navigate to the BackUpWordPress settings page.
3. Intercept the AJAX request for directory browsing (e.g., using Burp Suite).
4. Modify the hmbkp_directory_browse parameter to traverse directories:

   hmbkp_directory_browse=../../../../etc
   

5. Observe the response listing the contents of /etc.

Example cURL Command:

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=hmbkp_directory_browse&hmbkp_directory_browse=../../../../etc' \
  --cookie 'wordpress_logged_in_xxx=admin_cookie'

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual directory traversal patterns in AJAX requests to admin-ajax.php.
• Alert on requests containing hmbkp_directory_browse with ../ sequences.

Prevention:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Restrict admin access to trusted IPs only.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /wp-admin/admin-ajax.php with parameter hmbkp_directory_browse containing ../ or ..\\.
• Unusual file paths in the response body (e.g., /etc/passwd, /var/log).

File System IOCs:

• Unexpected access to files outside the WordPress installation directory.
• Log entries showing directory traversal attempts in web server logs.

Example Log Entry:

192.168.1.100 - - [01/Jan/2024:12:00:00 +0000] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2024_3034_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting BackUpWordPress plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3034"
    strings:
        $traversal = /hmbkp_directory_browse=[^&]*\.\.\//
        $admin_ajax = "admin-ajax.php"
    condition:
        $admin_ajax and $traversal
}

Sigma Rule

title: CVE-2024-3034 BackUpWordPress Directory Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects directory traversal attempts via hmbkp_directory_browse parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'hmbkp_directory_browse'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate admin browsing of backup directories
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3034 BackUpWordPress Directory Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"hmbkp_directory_browse"; http_client_body;
    content:"../"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the BackUpWordPress plugin until a patch is released.
2. Review admin accounts for any signs of compromise.
3. Monitor logs for directory traversal attempts.

Long-term Fix:

• Apply vendor patch when available.
• Implement input validation and path canonicalization in custom code.
• Use a WAF to block path traversal patterns.

Workaround:

• Restrict access to wp-admin via .htaccess or firewall rules.
• Use a security plugin to monitor file access.

Valters IT