CVE-2024-53811

Executive Summary

CVE-2024-53811 is a critical unrestricted file upload vulnerability in the POSIMYTH WDesignkit WordPress plugin, affecting versions up to and including 1.0.40. This flaw allows an authenticated attacker with low privileges to upload a web shell to the server, leading to full remote code execution and complete compromise of the WordPress site. The vulnerability resides in the plugin's file upload functionality, which fails to properly validate file types, enabling the upload of executable scripts such as PHP files. Given the widespread use of WordPress and the plugin's popularity, this poses a significant threat to site integrity and data confidentiality.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed WDesignkit from the WordPress dashboard or via direct download are at risk. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems. The supply chain risk is moderate, as the plugin is maintained by a single vendor (POSIMYTH) and the patch status remains unknown, potentially leaving many installations exposed.

CVSS Breakdown & Threat Level

• CVSS Score: 6.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with upload capability
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The medium severity rating reflects the requirement for authentication, but the potential impact is severe, as an attacker can gain full control over the web server and access sensitive data.

Deep Dive & Mechanics

The vulnerability exists in the WDesignkit plugin's file upload handler, likely within a function that processes media uploads for design kits. The plugin fails to restrict the file types that can be uploaded, allowing an attacker to upload a PHP web shell disguised as a legitimate file (e.g., .php, .phtml, .php5). The uploaded file is stored in the WordPress uploads directory, and the attacker can then access it directly via a web request to execute arbitrary commands.

The root cause is the absence of proper file type validation and the lack of checks for dangerous extensions. The plugin may rely on client-side validation or insufficient server-side checks, making it trivial to bypass.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the file upload function. A typical vulnerable implementation might look like:

// Vulnerable code (wdesignkit/includes/upload.php)
function wdesignkit_upload_file() {
    $file = $_FILES['file'];
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['path'] . '/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $target_path);
    return $target_path;
}

A patched version would include file type validation:

// Patched code
function wdesignkit_upload_file() {
    $file = $_FILES['file'];
    $allowed_types = array('jpg', 'jpeg', 'png', 'gif', 'svg');
    $file_ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
    if (!in_array($file_ext, $allowed_types)) {
        wp_die('Invalid file type.');
    }
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['path'] . '/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $target_path);
    return $target_path;
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: A WordPress site with WDesignkit <= 1.0.40 installed and an authenticated user account with upload privileges (e.g., Author or Editor role).
2. Craft a Web Shell: Create a PHP file (e.g., shell.php) containing:

   <?php system($_GET['cmd']); ?>
   

3. Upload the Shell: Use the plugin's upload functionality (e.g., via a POST request to /wp-admin/admin-ajax.php?action=wdesignkit_upload) with the malicious file.
4. Access the Shell: Navigate to the uploaded file path, typically /wp-content/uploads/YYYY/MM/shell.php?cmd=id.
5. Escalate Privileges: Use the shell to extract WordPress database credentials, install backdoors, or pivot to other systems.

Blue Team

1. Monitor File Uploads: Enable logging for all file uploads and inspect for suspicious file extensions (.php, .phtml, .php5, .shtml).
2. Web Application Firewall (WAF): Deploy rules to block uploads of executable scripts in the uploads directory.
3. File Integrity Monitoring: Use tools like Tripwire or OSSEC to detect new files in the uploads directory.
4. Restrict Upload Permissions: Limit upload capabilities to trusted users only and disable PHP execution in the uploads directory via .htaccess:

   <FilesMatch "\.php$">
   Deny from all
   </FilesMatch>
   

5. Patch Management: Immediately update the plugin if a patch becomes available; otherwise, consider disabling the plugin.

Indicators of Compromise (IOCs)

• File Artifacts: Unexpected .php, .phtml, .php5 files in /wp-content/uploads/YYYY/MM/ directory.
• Network Traffic: Outbound connections from the web server to unknown IPs or domains (e.g., for C2 communication).
• Log Entries: POST requests to /wp-admin/admin-ajax.php with action=wdesignkit_upload and file names containing suspicious extensions.
• Process Anomalies: Unusual processes like cmd.exe or /bin/sh spawned by the web server user.

Detection Engineering

YARA Rule

rule CVE_2024_53811_Webshell_Upload {
    meta:
        description = "Detects PHP web shell uploads targeting CVE-2024-53811 in WDesignkit"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-53811"
    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $shell_func = /shell_exec\s*\(/
        $cmd_param = /\$_GET\s*\[\s*['"]cmd['"]\s*\]/
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param)
}

Sigma Rule

title: CVE-2024-53811 WDesignkit Webshell Upload
id: 8a3f7b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP POST requests uploading PHP files to WDesignkit upload endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query: action=wdesignkit_upload
        sc-status: 200
        cs-content-type: multipart/form-data
    file_extension:
        cs-uri-stem|endswith:
            - '.php'
            - '.phtml'
            - '.php5'
    condition: selection and file_extension
falsepositives:
    - Legitimate plugin updates (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-53811 WDesignkit Webshell Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wdesignkit_upload"; http_uri; content:".php"; http_client_body; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WDesignkit plugin until a patch is released.
2. Workaround: Add the following rule to the .htaccess file in the uploads directory to block PHP execution:

   <FilesMatch "\.php$">
   Deny from all
   </FilesMatch>
   

3. Monitor: Review server logs for any signs of exploitation and scan for uploaded web shells.
4. Patch: Apply the vendor's patch as soon as it becomes available.
5. Long-term: Implement a Web Application Firewall (WAF) and enforce strict file upload validation for all plugins.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2024-53811