CVE-2024-6551

Executive Summary

CVE-2024-6551 is a Full Path Disclosure vulnerability affecting the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress, up to and including version 3.15.1. The vulnerability arises from the plugin’s use of the Symfony framework with display_errors enabled in test files. This configuration allows unauthenticated attackers to retrieve the full server path of the web application by triggering errors in these test files. While the exposed path alone is not directly exploitable, it provides critical information that can be used to facilitate other attacks, such as directory traversal or file inclusion. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood at this time. No public exploit code or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress ecosystem, affecting the GiveWP plugin. It does not involve the underlying web server (Apache or Nginx) but rather the plugin’s misconfiguration.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to information disclosure. It is primarily useful as a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability is rooted in the GiveWP plugin’s use of the Symfony framework. Symfony’s debugging tools, when display_errors is enabled, can reveal sensitive information such as the full server path in error messages. The plugin includes test files that are accessible to unauthenticated users. When these test files encounter an error (e.g., a missing dependency or misconfiguration), the error message includes the absolute filesystem path.

Technical Flow:

1. An unauthenticated attacker sends a request to a test file, such as /wp-content/plugins/givewp/tests/....
2. The test file triggers an error (e.g., a PHP notice or exception).
3. Because display_errors is enabled, the error output includes the full path, e.g., /var/www/html/wp-content/plugins/givewp/....
4. The attacker captures this path and uses it to map the server’s directory structure.

Why This Matters: While the path alone is not a direct exploit, it can be used to:

• Identify the exact location of configuration files (e.g., wp-config.php).
• Aid in directory traversal attacks by confirming the path structure.
• Support file inclusion attacks by providing a known base path.

Vulnerable vs. Patched Code

Vulnerable Code (GiveWP <= 3.15.1): The vulnerability exists in test files that have display_errors enabled. For example, a test bootstrap file might contain:

ini_set('display_errors', 1);
error_reporting(E_ALL);

This configuration, combined with accessible test files, leads to path disclosure.

Patched Code (Hypothetical): A patch would involve:

• Disabling display_errors in test files or restricting access to them.
• Using a custom error handler that sanitizes error messages.
• Removing test files from production deployments.

Example of a patched approach:

// Disable display_errors in production
ini_set('display_errors', 0);
error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with GiveWP plugin version <= 3.15.1.
• No authentication required.

Exploitation Steps:

1. Identify the GiveWP plugin’s test file path. Common locations include:
   • /wp-content/plugins/givewp/tests/
   • /wp-content/plugins/givewp/vendor/symfony/...
2. Send a request to a test file that triggers an error. For example:

   GET /wp-content/plugins/givewp/tests/bootstrap.php HTTP/1.1
   Host: target.com
   

3. Observe the response for error messages containing the full path.

Example Request:

curl -v "http://target.com/wp-content/plugins/givewp/tests/bootstrap.php"

Expected Response (truncated):

Warning: require(/var/www/html/wp-content/plugins/givewp/vendor/autoload.php): failed to open stream: No such file or directory in /var/www/html/wp-content/plugins/givewp/tests/bootstrap.php on line 5

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /wp-content/plugins/givewp/tests/ or similar paths.
• Look for error responses containing filesystem paths (e.g., /var/www/, /home/).

Mitigation:

• Remove test files from production deployments.
• Disable display_errors in php.ini or via .htaccess:

  php_flag display_errors off
  

• Use a Web Application Firewall (WAF) to block requests to test directories.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/givewp/tests/, /wp-content/plugins/givewp/vendor/symfony/
• Error Messages: Strings containing /var/www/html/, /home/, or other absolute paths in HTTP responses.
• HTTP Requests: GET/POST requests to test files with unusual parameters.
• Log Entries: PHP warnings or notices in server logs referencing test files.

Detection Engineering

YARA Rule

rule CVE_2024_6551_GiveWP_Path_Disclosure {
    meta:
        description = "Detects GiveWP full path disclosure attempts"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6551"
    strings:
        $path1 = "/var/www/html" ascii wide nocase
        $path2 = "/home/" ascii wide nocase
        $path3 = "givewp/tests" ascii wide nocase
        $error = "Warning:" ascii wide nocase
    condition:
        any of ($path1, $path2) and $path3 and $error
}

Sigma Rule

title: GiveWP Full Path Disclosure Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2024-6551 by accessing GiveWP test files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/wp-content/plugins/givewp/tests/'
    condition: selection
falsepositives:
    - Legitimate plugin testing (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6551 GiveWP Full Path Disclosure Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/givewp/tests/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable display_errors: Set display_errors = Off in php.ini or via .htaccess.
2. Remove Test Files: Delete or restrict access to the /wp-content/plugins/givewp/tests/ directory.
3. Update Plugin: Monitor the GiveWP plugin page for a patched version and apply it as soon as available.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block requests to test directories.
• Regularly audit WordPress plugins for misconfigurations.
• Use security plugins like Wordfence to detect and block path disclosure attempts.

Workaround: If immediate patching is not possible, add the following to .htaccess:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-content/plugins/givewp/tests/ - [F,L]
</IfModule>

Valters IT
Securing Digital Frontiers