CVE-2024-6546

Executive Summary

CVE-2024-6546 is a Full Path Disclosure vulnerability affecting the One Click Close Comments WordPress plugin, versions up to and including 2.7.1. The vulnerability arises from the plugin's inclusion of bootstrap test files with display_errors enabled. This configuration allows unauthenticated attackers to retrieve the full server path of the web application, which can be used to aid further attacks such as Local File Inclusion (LFI) or SQL injection. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the One Click Close Comments plugin. As a WordPress plugin, it is distributed via the official WordPress plugin repository. Users are advised to monitor the plugin's page for updates and consider disabling the plugin if no patch is provided.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but only discloses the server path, which is not directly harmful. However, it can be chained with other vulnerabilities to cause significant damage.

Deep Dive & Mechanics

The One Click Close Comments plugin includes bootstrap test files (likely from the Bootstrap framework) that have display_errors enabled. When these files are accessed, PHP error messages may reveal the full file system path of the WordPress installation. For example, accessing a test file like /wp-content/plugins/one-click-close-comments/bootstrap/test.php could trigger an error that displays the path.

The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The disclosed path can be used to:

• Identify the server's directory structure.
• Aid in Local File Inclusion (LFI) attacks.
• Assist in SQL injection attacks by providing context for error-based injection.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.7.1): The plugin includes bootstrap test files with display_errors enabled. Example of a vulnerable file:

<?php
// bootstrap/test.php
ini_set('display_errors', 1);
error_reporting(E_ALL);
// ... test code that may produce errors
?>

Patched Code (Hypothetical): A patch would remove or disable the test files, or set display_errors to 0 in production. Example:

<?php
// bootstrap/test.php
ini_set('display_errors', 0);
error_reporting(0);
// ... test code
?>

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify WordPress sites using the plugin via Shodan dorks or manual inspection.
2. Path Disclosure: Access the test file directly:

   http://target.com/wp-content/plugins/one-click-close-comments/bootstrap/test.php
   

   If the file exists and triggers an error, the full path will be displayed.
3. Chaining: Use the disclosed path to perform LFI or SQL injection attacks.

Blue Team

1. Detection: Monitor access logs for requests to /wp-content/plugins/one-click-close-comments/bootstrap/ or similar paths.
2. Mitigation: Remove or rename the test files, or set display_errors to 0 in wp-config.php.
3. Harden: Ensure error reporting is disabled in production environments.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/one-click-close-comments/bootstrap/test.php
  • /wp-content/plugins/one-click-close-comments/bootstrap/
• Log Entries:
  • HTTP 200 responses to the above paths.
  • Error messages containing the server path in the response body.
• Network Traffic:
  • GET requests to the vulnerable paths from unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2024_6546_OneClickCloseComments_FPD {
    meta:
        description = "Detects One Click Close Comments plugin test files with display_errors enabled"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-6546"
    strings:
        $test_file = "bootstrap/test.php"
        $display_errors = "display_errors"
        $error_reporting = "error_reporting"
    condition:
        $test_file and ($display_errors or $error_reporting)
}

Sigma Rule

title: CVE-2024-6546 - One Click Close Comments Full Path Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to One Click Close Comments plugin test files that may disclose full path
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains: '/wp-content/plugins/one-click-close-comments/bootstrap/'
    condition: selection
falsepositives:
    - Legitimate plugin updates or maintenance
level: medium
tags:
    - attack.t1083
    - cve.2024.6546

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6546 - One Click Close Comments Full Path Disclosure"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/one-click-close-comments/bootstrap/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Remove or rename the bootstrap directory within the plugin folder.
2. Configuration: Set display_errors to Off in php.ini or wp-config.php:

   ini_set('display_errors', 0);
   

3. Plugin Update: Monitor the WordPress plugin repository for an official patch. If none is provided, consider disabling the plugin.
4. Web Application Firewall (WAF): Block requests to /wp-content/plugins/one-click-close-comments/bootstrap/ using WAF rules.
5. Regular Audits: Conduct periodic security audits of all installed plugins.

Valters IT
Securing Digital Frontiers