CVE-2024-52386

Executive Summary

CVE-2024-52386 is a PHP Local File Inclusion (LFI) vulnerability affecting the Classified Listing WordPress plugin by RadiusTheme, up to and including version 3.1.16. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to information disclosure, such as reading sensitive configuration files (e.g., wp-config.php), source code, or logs. The CVSS score is 5.3 (Medium), with a low attack complexity and no user interaction required. No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the widespread use of WordPress and the plugin's popularity.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates from RadiusTheme and apply patches immediately. Since the patch status is unknown, manual mitigation (e.g., disabling the plugin or applying a WAF rule) is recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the impact is limited to file reading, the lack of authentication and low complexity makes it attractive for reconnaissance and chaining with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability exists in the classified-listing plugin's PHP code, likely in a function that dynamically includes files based on user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST). The improper control of the filename allows path traversal sequences (e.g., ../../) to be injected, enabling the inclusion of arbitrary files from the server's filesystem.

Root Cause: The plugin fails to sanitize or validate the filename parameter before passing it to PHP functions like include(), require(), or file_get_contents(). This allows an attacker to specify a path outside the intended directory.

Attack Vector: An unauthenticated HTTP request to a vulnerable endpoint (e.g., /wp-content/plugins/classified-listing/some-file.php?file=../../../etc/passwd).

Impact: Successful exploitation allows reading sensitive files, including:

• WordPress configuration (wp-config.php) containing database credentials.
• Server configuration files (e.g., /etc/passwd, /etc/shadow).
• Source code of other plugins/themes.
• Log files (e.g., /var/log/apache2/access.log).

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable pattern. A typical vulnerable code snippet might look like:

// Vulnerable code (classified-listing <= 3.1.16)
$file = $_GET['file'];
include($file . '.php');

A patched version would include proper validation:

// Patched code (hypothetical)
$allowed_files = array('listings', 'details', 'search');
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include(plugin_dir_path(__FILE__) . 'templates/' . $file . '.php');
} else {
    // Error handling
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Classified Listing plugin <= 3.1.16.
• Knowledge of the vulnerable endpoint (e.g., /wp-content/plugins/classified-listing/includes/class-shortcode.php?file=...).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., file, template, include).
2. Craft a request to read /etc/passwd:

   GET /wp-content/plugins/classified-listing/includes/class-shortcode.php?file=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the response will contain the contents of /etc/passwd.

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  # Install plugin manually via wp-cli or upload
  

• Alternatively, use a local LAMP stack with the plugin installed.

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Look for requests to plugin files with suspicious parameters.

Mitigation:

• Apply a Web Application Firewall (WAF) rule to block path traversal attempts.
• Disable the plugin until a patch is available.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be 600).

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /wp-config.php, /var/log/apache2/access.log
• URL Patterns: ?file=, ?template=, ?include= with ../ sequences.
• Log Entries: HTTP requests containing %2e%2e%2f or ..%2f in the query string.
• Network: Outbound connections from the web server to unknown IPs (if chained with RFI).

Detection Engineering

YARA Rule

rule CVE_2024_52386_LFI_Classified_Listing {
    meta:
        description = "Detects LFI attempts against Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52386"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/ nocase
        $plugin_path = "/wp-content/plugins/classified-listing/" nocase
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env)/ nocase
    condition:
        $plugin_path and $path_traversal and $sensitive_file
}

Sigma Rule

title: CVE-2024-52386 - Classified Listing LFI Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b3d1f0a9e8c
status: experimental
description: Detects path traversal attempts targeting Classified Listing plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'classified-listing'
            - '..%2f'
            - '%2e%2e%2f'
            - 'file='
    condition: selection
falsepositives:
    - Legitimate use of file parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52386 - Classified Listing LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/classified-listing/"; http_uri; content:"../"; http_uri; distance:0; content:"etc/passwd"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Classified Listing plugin until a patch is released.
2. Short-term: Implement a WAF rule to block path traversal patterns (e.g., .., %2e%2e%2f).
3. Long-term: Apply the official patch from RadiusTheme once available. Monitor the plugin's changelog.
4. General: Ensure WordPress core, themes, and other plugins are up-to-date. Use a security plugin (e.g., Wordfence) for additional protection.

Valters IT
Securing Digital Frontiers