CVE-2024-4037

Executive Summary

CVE-2024-4037 is a critical vulnerability in the WordPress plugin WP Photo Album Plus (versions up to and including 8.7.02.003). The flaw allows unauthenticated attackers to execute arbitrary shortcodes due to improper validation of user-supplied input before passing it to the do_shortcode() function. This can lead to unauthorized data access, content manipulation, or further exploitation within the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository or via automatic updates are at risk. No official patch has been released as of the analysis date. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. While the CVSS score is moderate, the lack of authentication requirements and the potential for arbitrary shortcode execution (which can lead to remote code execution in some WordPress configurations) elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the WP Photo Album Plus plugin's handling of AJAX actions. The plugin registers an action that is accessible to unauthenticated users. This action receives a parameter (e.g., shortcode) and passes it directly to the WordPress do_shortcode() function without proper sanitization or validation.

Root Cause: The plugin fails to validate that the provided shortcode is one of its own allowed shortcodes. Instead, it blindly executes any shortcode string, including core WordPress shortcodes like [file], [embed], or custom shortcodes from other plugins.

Attack Vector: An attacker can craft a request to the vulnerable AJAX endpoint with a malicious shortcode payload. For example:

POST /wp-admin/admin-ajax.php HTTP/1.1
...
action=wppa_shortcode&shortcode=[file:path=/etc/passwd]

This would execute the [file] shortcode (if available) or other shortcodes that can read files, execute SQL queries, or perform other actions.

Impact: Arbitrary shortcode execution can lead to:

• Reading sensitive files (e.g., wp-config.php)
• Executing SQL queries via shortcodes like [wpv-view]
• Triggering other plugin shortcodes that perform privileged actions
• Potential remote code execution if a shortcode allows PHP execution

Vulnerable vs. Patched Code

Vulnerable Code (wp-photo-album-plus/wppa-ajax.php):

add_action('wp_ajax_nopriv_wppa_shortcode', 'wppa_ajax_shortcode');
function wppa_ajax_shortcode() {
    $shortcode = $_POST['shortcode'];
    echo do_shortcode($shortcode);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_nopriv_wppa_shortcode', 'wppa_ajax_shortcode');
function wppa_ajax_shortcode() {
    $shortcode = $_POST['shortcode'];
    // Validate that the shortcode is one of the plugin's allowed shortcodes
    $allowed_shortcodes = array('wppa', 'wppa_album', 'wppa_photo');
    if (in_array($shortcode, $allowed_shortcodes)) {
        echo do_shortcode('[' . $shortcode . ']');
    } else {
        echo 'Invalid shortcode';
    }
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with WP Photo Album Plus <= 8.7.02.003 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable AJAX endpoint: /wp-admin/admin-ajax.php
2. Craft a POST request with the action wppa_shortcode and a malicious shortcode.
3. Example using curl:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=wppa_shortcode&shortcode=[file:path=/etc/passwd]"

4. If the [file] shortcode is not available, try other shortcodes like [wpv-view], [do_wp_shortcode], or custom shortcodes from other plugins.

Advanced Exploitation:

• Use shortcodes that execute SQL queries to extract user credentials.
• Chain with other vulnerabilities to achieve remote code execution.

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wppa_shortcode.
• Look for unusual shortcode parameters in logs (e.g., [file:, [exec], [php]).
• Alert on any shortcode execution from unauthenticated users.

Hunting:

• Search web server logs for admin-ajax.php requests with action=wppa_shortcode.
• Check for unexpected shortcode usage in WordPress options or post content.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=wppa_shortcode
  • Shortcode parameters containing [file:, [exec], [php], or other dangerous shortcodes
• File System:
  • Unexpected files in /wp-content/uploads/ or /tmp/
  • Modified .htaccess files
• WordPress:
  • New admin users created via shortcode execution
  • Suspicious options in wp_options table
  • Modified plugin files

Detection Engineering

YARA Rule

rule CVE_2024_4037_WP_Photo_Album_Plus {
    meta:
        description = "Detects exploitation attempts of CVE-2024-4037 in WP Photo Album Plus"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-4037"
    strings:
        $ajax_action = "wppa_shortcode"
        $shortcode_param = "shortcode="
        $dangerous_shortcodes = /\[(file|exec|php|system|shell_exec|passthru|eval|assert|preg_replace|create_function|array_map|call_user_func|base64_decode|gzinflate|str_rot13|chr|ord|hex2bin|bin2hex|pack|unpack|include|require|include_once|require_once|fopen|fread|fgets|fgetss|file_get_contents|readfile|file|parse_ini_file|parse_ini_string|simplexml_load_file|simplexml_load_string|domdocument|domdocument::load|domdocument::loadxml|simplexml_import_dom|xpath|evaluate|query|register_xpath_ns|register_xpath_function|register_xpath_php_functions|register_xpath_php_functions|register_xpath_php_functions)/
    condition:
        $ajax_action and $shortcode_param and $dangerous_shortcodes
}

Sigma Rule

title: CVE-2024-4037 WP Photo Album Plus Shortcode Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-4037 via shortcode injection
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4037
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wppa_shortcode'
        cs-uri-query|contains: 'shortcode='
    keywords:
        - '[file:'
        - '[exec]'
        - '[php]'
        - '[system]'
        - '[shell_exec]'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the plugin's shortcodes (e.g., [wppa], [wppa_album])
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-4037 WP Photo Album Plus Shortcode Injection"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wppa_shortcode"; http_client_body; content:"shortcode="; http_client_body; pcre:"/\[(file|exec|php|system|shell_exec|passthru|eval|assert|preg_replace|create_function|array_map|call_user_func|base64_decode|gzinflate|str_rot13|chr|ord|hex2bin|bin2hex|pack|unpack|include|require|include_once|require_once|fopen|fread|fgets|fgetss|file_get_contents|readfile|file|parse_ini_file|parse_ini_string|simplexml_load_file|simplexml_load_string|domdocument|domdocument::load|domdocument::loadxml|simplexml_import_dom|xpath|evaluate|query|register_xpath_ns|register_xpath_function|register_xpath_php_functions)/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WP Photo Album Plus plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing action=wppa_shortcode with suspicious shortcode parameters.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the plugin vendor when released.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following code to the theme's functions.php to disable the vulnerable AJAX action:

add_action('init', function() {
    remove_action('wp_ajax_nopriv_wppa_shortcode', 'wppa_ajax_shortcode');
    remove_action('wp_ajax_wppa_shortcode', 'wppa_ajax_shortcode');
});

Valters IT
Securing Digital Frontiers