CVE-2024-56216

Executive Summary

CVE-2024-56216 is a PHP Local File Inclusion (LFI) vulnerability affecting the Themify Builder WordPress plugin, versions up to and including 7.6.3. This vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. Successful exploitation can lead to sensitive information disclosure (e.g., reading /etc/passwd, wp-config.php), and in some configurations, may lead to remote code execution if combined with file upload capabilities or log poisoning.

This vulnerability is classified as WordPress ecosystem issue, specifically within the Themify Builder plugin. The CVSS score is 6.5 (Medium), but the actual risk is elevated due to the lack of authentication requirements and the potential for information disclosure.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The supply chain risk is moderate, as the vulnerable component is a widely used page builder. Users are advised to verify the integrity of their plugin files and monitor for official patches from Themify.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited file read capability.
• Integrity (I): Low (L) - Potential for file inclusion leading to code execution.
• Availability (A): Low (L) - Potential for denial of service via resource exhaustion.

Threat Level: Medium-High. While the base score is 6.5, the ease of exploitation and potential for privilege escalation make it a significant threat in real-world scenarios.

Deep Dive & Mechanics

The vulnerability lies in the improper sanitization of a filename parameter used in a PHP include() or require() statement within the Themify Builder plugin. The plugin likely accepts a user-supplied path (e.g., via a GET or POST parameter) to load template files or assets. Without proper validation, an attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files from the server.

Key Technical Details:

• The vulnerable parameter is likely related to template loading or asset inclusion.
• The plugin fails to sanitize or validate the input, allowing directory traversal.
• PHP's include() function will execute PHP code if the included file contains PHP tags, potentially leading to RCE.
• The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion').

Attack Vector:

1. Attacker sends a crafted HTTP request to the WordPress site.
2. The request includes a parameter (e.g., ?themify_template=../../../../etc/passwd).
3. The plugin includes the specified file, outputting its contents.
4. If the attacker can control the content of the included file (e.g., via log poisoning or file upload), they can achieve RCE.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common LFI vulnerabilities.

Vulnerable Code (Conceptual):

$template = $_GET['template'];
include( 'templates/' . $template . '.php' );

Patched Code (Conceptual):

$allowed_templates = array('default', 'fullwidth', 'sidebar');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include( 'templates/' . $template . '.php' );
} else {
    // Handle error
}

The patched version uses a whitelist approach, ensuring only predefined templates can be included.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Themify Builder <= 7.6.3 installed and activated.
• Knowledge of the vulnerable parameter (e.g., themify_template, builder_file, etc.).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy (e.g., Burp Suite) to intercept requests and look for parameters that load files.
2. Craft the LFI payload: Use path traversal to read sensitive files.

   GET /?themify_template=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Read sensitive files: If successful, the contents of /etc/passwd will be displayed.
4. Attempt RCE: If file upload is possible (e.g., via media library), upload a PHP shell and include it.

   GET /?themify_template=../../../../wp-content/uploads/2024/01/shell.php HTTP/1.1
   

Example Payloads:

• Read wp-config.php: ../../../../wp-config.php
• Read /etc/passwd: ../../../../etc/passwd
• Read Apache logs (for log poisoning): ../../../../var/log/apache2/access.log

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, ..\\, %2e%2e%2f).
• Look for requests to the Themify Builder plugin with suspicious parameters.
• Use WAF rules to block directory traversal attempts.

Hunting:

• Search web server logs for requests containing themify_template, builder_file, or similar parameters.
• Check for unusual file inclusion errors in PHP error logs.
• Monitor for outbound connections from the web server (potential data exfiltration).

Lab Setup:

1. Install a local WordPress instance (e.g., using Docker).
2. Install Themify Builder version 7.6.3.
3. Use a tool like curl or Burp Suite to send malicious requests.
4. Monitor logs and responses.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..\\ in parameters related to Themify Builder.
  • Requests to wp-content/plugins/themify-builder/ with suspicious query strings.
  • Unusual file paths in HTTP responses (e.g., /etc/passwd content).

• File System IOCs:

  • Unexpected files in the web root (e.g., PHP shells).
  • Modified .htaccess files (if attacker gains write access).
  • Suspicious entries in web server logs (e.g., include() errors).

• Log IOCs:

  • PHP warnings/errors related to include() or require() with user-supplied paths.
  • Apache/Nginx access logs showing path traversal attempts.

Detection Engineering

YARA Rule

rule Detect_Themify_Builder_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2024-56216 LFI in Themify Builder"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56216"
    strings:
        $param1 = "themify_template" nocase
        $param2 = "builder_file" nocase
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
    condition:
        any of ($param*) and any of ($traversal*)
}

Sigma Rule

title: Themify Builder LFI Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-56216
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'themify_template'
            - 'builder_file'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Themify Builder LFI Attempt"; flow:to_server,established; content:"themify_template"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply a virtual patch using a WAF (e.g., ModSecurity, Cloudflare) to block path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be 600 or 640).

Long-term Fix:

• Monitor the Themify plugin repository for an official patch.
• Implement input validation and whitelisting for all file inclusion parameters.
• Use a security plugin (e.g., Wordfence) to add an additional layer of protection.

Workarounds:

• If the plugin is essential, consider using a custom filter to sanitize the vulnerable parameter:

  add_filter('themify_builder_template_path', function($path) {
      // Implement whitelist logic here
      return $path;
  });
  

Valters IT
Securing Digital Frontiers