CVE-2024-52450

Executive Summary

CVE-2024-52450 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin nBlocks by Officialprocoders. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The plugin is vulnerable up to and including version 1.0.2. No official patch has been released at the time of analysis, and no public proof-of-concept exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed nBlocks from the WordPress dashboard or via direct download are at risk. The lack of a patch means that the supply chain for this plugin is currently compromised, and users must rely on manual mitigation or removal of the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) - Sensitive files can be read.
• Integrity (I): None (N) - File contents cannot be modified.
• Availability (A): None (N) - Service availability is not directly impacted.

CVSS Score: 7.5 (High) - This score reflects the ease of exploitation and the high potential for information disclosure.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) issue. The nBlocks plugin likely uses a dynamic include or require statement where the filename is constructed from user-supplied input without proper sanitization. For example, a parameter like page or file might be passed via a GET request and directly used in an include() call.

Vulnerable Code Pattern (Hypothetical):

<?php
$page = $_GET['page'];
include( $page . '.php' );
?>

An attacker can manipulate the page parameter to traverse directories and include arbitrary files. For instance, to read the WordPress configuration file, an attacker could use:

http://target.com/wp-content/plugins/nblocks/somepage.php?page=../../../../wp-config

The .php extension appended by the vulnerable code can be bypassed using a null byte injection (in older PHP versions) or by using a path that already ends with .php (e.g., php://filter/convert.base64-encode/resource=wp-config). The php://filter wrapper is particularly dangerous as it allows reading files without the .php extension being executed.

Vulnerable vs. Patched Code

Since no official patch is available, we can only hypothesize the fix. A patched version would implement strict input validation and whitelisting.

Vulnerable Code (Hypothetical):

<?php
$page = $_GET['page'];
include( $page . '.php' );
?>

Patched Code (Hypothetical):

<?php
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include( $page . '.php' );
} else {
    // Handle error
    echo 'Invalid page.';
}
?>

The patched version uses a whitelist of allowed page names, preventing any arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a WordPress instance with the nBlocks plugin version 1.0.2 installed and activated.
2. Reconnaissance: Identify the vulnerable parameter. Common parameters include page, file, template, or include. Use a web proxy (e.g., Burp Suite) to intercept requests and fuzz parameters.
3. Exploitation:
   • Basic LFI: Attempt to read /etc/passwd:

     GET /wp-content/plugins/nblocks/vulnerable-page.php?page=../../../../../../etc/passwd%00
     

   • PHP Wrapper (for reading PHP files):

     GET /wp-content/plugins/nblocks/vulnerable-page.php?page=php://filter/convert.base64-encode/resource=../../../../wp-config
     

     Decode the base64 output to retrieve the wp-config.php contents.
4. Post-Exploitation: If file upload is possible (e.g., via another plugin), upload a malicious PHP file and include it to achieve Remote Code Execution (RCE).

Blue Team (Detection & Defense)

1. Detection:
   • Monitor web server logs for suspicious GET requests containing ../, %00, or php://filter.
   • Look for requests to nblocks plugin files with unexpected parameters.
2. Defense:
   • Immediate: Disable or remove the nBlocks plugin until a patch is available.
   • Web Application Firewall (WAF): Create rules to block requests containing path traversal sequences (../) or PHP wrappers (php://).
   • Input Validation: Ensure all user-supplied input is validated against a whitelist.
   • Disable allow_url_include: In php.ini, set allow_url_include = Off to prevent remote file inclusion, though this does not block local file inclusion.
   • Disable allow_url_fopen: Set allow_url_fopen = Off to prevent the use of wrappers like php://filter.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/nblocks/ (plugin directory)
• Log Entries:
  • GET requests containing ../ or php://filter in the query string.
  • Requests to nblocks plugin files with unusual parameters.
• Network Traffic:
  • Outbound connections from the web server to unknown IPs (if RCE is achieved).
• File System:
  • Unexpected files in the web root (e.g., shell.php).
  • Modified .htaccess files.

Detection Engineering

YARA Rule

rule Detect_nBlocks_LFI_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-52450 in nBlocks WordPress plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-52450"
    strings:
        $path_traversal = /\.\.\//
        $php_wrapper = /php:\/\//
        $nblocks_param = /nblocks/i
    condition:
        any of ($path_traversal, $php_wrapper) and $nblocks_param
}

Sigma Rule

title: Detect nBlocks LFI Exploitation Attempts
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-52450
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '..'
            - 'php://filter'
            - 'php://input'
        cs-uri-stem|contains: '/wp-content/plugins/nblocks/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-52450 - nBlocks LFI Exploitation Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/nblocks/"; http_uri;
    content:"../"; http_uri; distance:0;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Disable and uninstall the nBlocks plugin from all WordPress installations.
2. Vendor Contact: Attempt to contact Officialprocoders for a patch. If no response, consider forking the plugin and applying a fix yourself.
3. Long-Term Solution: Implement a Web Application Firewall (WAF) with rules to block path traversal and PHP wrapper attacks. Regularly update all plugins and themes.
4. Code Review: If you must continue using the plugin, perform a thorough code review to identify and fix the vulnerable include/require statements.
5. Server Hardening:
   • Set open_basedir in php.ini to restrict file access to the web root.
   • Disable allow_url_include and allow_url_fopen.
   • Run PHP as a low-privileged user.

Valters IT - Securing Your Digital Frontier