CVE-2024-6312

Executive Summary

CVE-2024-6312 is a critical arbitrary file deletion vulnerability in the Funnelforms Free WordPress plugin (versions up to and including 3.7.3.2). The flaw resides in the af2DeleteFontFile function, which fails to properly validate file paths before deletion. An authenticated attacker with administrator-level privileges can exploit this to delete arbitrary files, including wp-config.php, potentially leading to complete site takeover and remote code execution.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a core configuration file, enabling attackers to reset the site or inject malicious code. The CVSS score of 6.5 reflects the high impact on integrity and availability, though the attack complexity is low and privileges are required.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (Funnelforms) and consider disabling the plugin until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): High (H) – Arbitrary file deletion can corrupt the site.
• Availability (A): High (H) – Deletion of critical files can cause denial of service.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation probability currently), the impact is severe and the attack vector is straightforward for authenticated admins.

Deep Dive & Mechanics

The vulnerability exists in the af2DeleteFontFile function within the Funnelforms Free plugin. This function is intended to delete font files uploaded by administrators. However, it does not sanitize or validate the file path provided by the user. An attacker can supply a path traversal sequence (e.g., ../../wp-config.php) to delete files outside the intended directory.

Root Cause: The function likely uses a user-supplied parameter (e.g., file_path) directly in a file deletion operation (like PHP's unlink()) without checking if the path is within an allowed directory.

Attack Flow:

1. Authenticate as an administrator.
2. Send a crafted POST request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=af2_delete_font_file).
3. Include a parameter like file_path=../../wp-config.php.
4. The plugin deletes the specified file, potentially breaking the WordPress installation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

function af2DeleteFontFile() {
    $file_path = $_POST['file_path'];
    if (file_exists($file_path)) {
        unlink($file_path);
    }
}

Patched Code (Expected):

function af2DeleteFontFile() {
    $file_path = $_POST['file_path'];
    $allowed_dir = WP_CONTENT_DIR . '/uploads/funnelforms/fonts/';
    $real_path = realpath($file_path);
    if ($real_path && strpos($real_path, $allowed_dir) === 0 && file_exists($real_path)) {
        unlink($real_path);
    }
}

The patched version uses realpath() to resolve the canonical path and checks that it starts with the allowed directory, preventing path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Funnelforms Free <= 3.7.3.2 installed and activated.
• Administrator credentials.

Exploit Steps:

1. Log in as an admin.
2. Identify the AJAX action: af2_delete_font_file.
3. Send a POST request to /wp-admin/admin-ajax.php with the action and a malicious file path.

Example cURL Command:

curl -X POST \
  -d "action=af2_delete_font_file&file_path=../../wp-config.php" \
  -c cookies.txt \
  http://target.com/wp-admin/admin-ajax.php

Expected Outcome: The wp-config.php file is deleted, causing the site to become inaccessible or allowing further exploitation (e.g., reinstallation with attacker-controlled database credentials).

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=af2_delete_font_file.
• Alert on file paths containing ../ or absolute paths outside the plugin's font directory.
• Check for sudden deletion of critical files like wp-config.php.

Response:

• Immediately revoke admin privileges if suspicious activity is detected.
• Restore deleted files from backup.
• Disable the Funnelforms plugin until a patch is applied.

Indicators of Compromise (IOCs)

• File Paths: ../../wp-config.php, ../../wp-content/plugins/, etc.
• HTTP Requests: POST to /wp-admin/admin-ajax.php with action=af2_delete_font_file and file_path parameter containing path traversal.
• Log Entries: PHP error logs showing unlink() failures or file deletion events.
• System State: Missing wp-config.php or other critical files.

Detection Engineering

YARA Rule

rule CVE_2024_6312_Funnelforms_File_Delete {
    meta:
        description = "Detects exploitation attempts of CVE-2024-6312 in Funnelforms plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6312"
    strings:
        $ajax_action = "af2_delete_font_file"
        $path_traversal = "../"
        $wp_config = "wp-config.php"
    condition:
        $ajax_action and ($path_traversal or $wp_config)
}

Sigma Rule

title: CVE-2024-6312 Funnelforms Arbitrary File Deletion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-6312 via POST requests to admin-ajax.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-post-body: 'action=af2_delete_font_file'
    condition: selection
falsepositives:
    - Legitimate admin font deletion (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-6312 Funnelforms Arbitrary File Deletion Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=af2_delete_font_file"; http_client_body;
    content:"file_path"; http_client_body;
    pcre:"/\.\.\//P";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Restrict admin access to only trusted users.
3. Monitor logs for suspicious file deletion attempts.

Long-term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Implement file integrity monitoring (e.g., Tripwire) to detect unauthorized deletions.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Workaround:

• Modify the plugin code to add path validation (as shown in the patched code example) if you have development resources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert