CVE-2024-35776

Executive Summary

CVE-2024-35776 is a vulnerability in the WordPress plugin phpinfo() WP by Exeebit, affecting versions through 5.0. The plugin exposes sensitive system information (PHP configuration, environment variables, server details) to any unauthenticated user who can access the WordPress site. This is a classic information disclosure issue (CWE-200) that can aid attackers in reconnaissance for further exploitation.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are affected. No official patch has been released as of this analysis. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (exposure of PHP configuration details)
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests this vulnerability is not currently being actively exploited in the wild, but the public availability of the vulnerable plugin makes it a target for automated scanners.

Deep Dive & Mechanics

The phpinfo() WP plugin provides a simple shortcode or admin page to display the output of PHP's phpinfo() function. The vulnerability arises because the plugin does not enforce any authentication or capability checks before rendering this sensitive information. An unauthenticated attacker can access the plugin's output page (typically at a URL like /wp-content/plugins/phpinfo-wp/phpinfo.php or via a shortcode on a public page) and retrieve:

• PHP version and configuration
• Server environment variables (including database credentials if exposed)
• Loaded PHP extensions
• Server software details (Apache/Nginx versions)
• File paths and document root

This information can be used to tailor further attacks, such as exploiting known vulnerabilities in specific PHP versions or server software.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire plugin. The core issue is the lack of an is_admin() or current_user_can() check before outputting phpinfo().

Vulnerable code (phpinfo-wp.php):

<?php
// No capability check
phpinfo();
?>

Hypothetical patched code:

<?php
if ( current_user_can( 'manage_options' ) ) {
    phpinfo();
} else {
    wp_die( 'Unauthorized access.' );
}
?>

Exploitation & Lab Setup

Red Team (Attacker)

1. Identify Target: Scan for WordPress sites using the plugin (e.g., via Shodan dork http.title:'phpinfo()').
2. Access phpinfo: Navigate to http://target/wp-content/plugins/phpinfo-wp/phpinfo.php or find the shortcode page.
3. Extract Data: Copy the entire output or use a tool like curl:

   curl http://target/wp-content/plugins/phpinfo-wp/phpinfo.php
   

4. Analyze: Look for sensitive environment variables (e.g., DB_PASSWORD, API_KEY), PHP version, and server paths.

Blue Team (Defender)

1. Detection: Monitor web server logs for requests to /wp-content/plugins/phpinfo-wp/phpinfo.php.
2. Blocking: Use a WAF rule to block access to that path for unauthenticated users.
3. Remediation: Remove or disable the plugin immediately. If needed, manually patch the plugin file as shown above.

Indicators of Compromise (IOCs)

• File Path: /wp-content/plugins/phpinfo-wp/phpinfo.php
• URL Pattern: */phpinfo-wp/phpinfo.php
• Response Content: Contains PHP Version, System, Server API, Loaded Configuration File
• HTTP Status: 200 OK with text/html content type and large response body (typically >10KB)

Detection Engineering

YARA Rule

rule detect_phpinfo_wp_exposure {
    meta:
        description = "Detects exposure of phpinfo() WP plugin output"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35776"
    strings:
        $phpinfo = "PHP Version" nocase
        $system = "System" nocase
        $server_api = "Server API" nocase
        $config_file = "Loaded Configuration File" nocase
    condition:
        all of them and filesize < 100KB
}

Sigma Rule

title: Detect phpinfo() WP Plugin Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to the phpinfo() WP plugin file
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem:
            - '/wp-content/plugins/phpinfo-wp/phpinfo.php'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35776 phpinfo() WP Access"; flow:to_server,established; content:"/wp-content/plugins/phpinfo-wp/phpinfo.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable and delete the phpinfo-wp plugin from the WordPress admin dashboard.
2. Alternative: If the plugin is required, manually edit phpinfo-wp.php to add a capability check (see patched code above).
3. Long-term: Monitor the WordPress plugin repository for an official patch. Consider using a security plugin that blocks access to sensitive files.
4. Prevention: Implement a Web Application Firewall (WAF) rule to block requests to /wp-content/plugins/phpinfo-wp/phpinfo.php from unauthenticated users.

Valters IT
Securing Digital Frontiers