CVE-2024-6552

Executive Summary

CVE-2024-6552 is a Full Path Disclosure vulnerability affecting the Amelia plugin for WordPress (Booking for Appointments and Events Calendar). The flaw exists in all versions up to and including 1.2. The vulnerability arises because the plugin uses the Symfony framework and leaves display_errors enabled in test files. This allows an unauthenticated attacker to retrieve the full server path of the web application, which can aid in further attacks such as Local File Inclusion (LFI) or Remote Code Execution (RCE) if other vulnerabilities are present.

The CVSS score is 5.3 (Medium), with a low EPSS score of 0.0%, indicating that exploitation is not currently widespread. However, the information disclosure can be a stepping stone for more severe attacks. As a WordPress ecosystem issue, the vulnerability is specific to the Amelia plugin and does not involve the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a WordPress plugin vulnerability. The supply chain risk is limited to the plugin's own code and its dependency on the Symfony framework. No open-source patch data or GitHub advisory is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Only the server path is disclosed.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No service disruption.

Threat Level: Medium. While the direct impact is low (path disclosure), it can be used to facilitate more severe attacks. The lack of a patch and the unauthenticated nature of the exploit increase the risk.

Deep Dive & Mechanics

The vulnerability is caused by the Amelia plugin's test files, which are part of the Symfony framework integration. These test files have display_errors set to On in the PHP configuration, which causes PHP to output detailed error messages, including the full server path, when an error occurs.

How it works:

1. An unauthenticated attacker sends a crafted HTTP request to a test file (e.g., /wp-content/plugins/amelia/vendor/symfony/.../test.php).
2. The test file triggers a PHP error (e.g., by passing invalid parameters).
3. Because display_errors is enabled, the error message includes the full file system path (e.g., /var/www/html/wp-content/plugins/amelia/...).
4. The attacker receives the path in the HTTP response.

Why it matters:

• The disclosed path reveals the directory structure, which can be used to locate other vulnerable files.
• It can help attackers bypass security measures like open_basedir or identify the exact location of configuration files.
• Combined with other vulnerabilities (e.g., LFI, SQLi), the path disclosure can lead to full compromise.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable state.

Vulnerable Code (example from a test file):

<?php
// test.php (vulnerable)
ini_set('display_errors', 1);
error_reporting(E_ALL);

// Some test logic that may fail
$foo = new Bar(); // This will cause a fatal error
?>

Patched Code (hypothetical):

<?php
// test.php (patched)
ini_set('display_errors', 0);
error_reporting(0);

// Or remove the test file entirely
?>

The fix would involve either:

• Setting display_errors to Off in the test files.
• Removing the test files from production deployments.
• Using a custom error handler that does not reveal paths.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Amelia plugin version <= 1.2.
• Network access to the site.

Steps:

1. Identify the test file location. Common paths include:
   • /wp-content/plugins/amelia/vendor/symfony/symfony/src/Symfony/Bundle/FrameworkBundle/Tests/...
   • /wp-content/plugins/amelia/vendor/symfony/.../test.php
2. Send a request that triggers an error. For example:

   curl -v "http://target.com/wp-content/plugins/amelia/vendor/symfony/symfony/src/Symfony/Bundle/FrameworkBundle/Tests/Controller/ControllerTest.php?invalid_param"
   

3. Look for the full path in the response body or headers. Example output:

   Warning: require(/var/www/html/wp-content/plugins/amelia/vendor/symfony/...): failed to open stream: No such file or directory in /var/www/html/wp-content/plugins/amelia/vendor/symfony/... on line 42
   

4. Use the disclosed path for further attacks (e.g., LFI, file upload).

No exploit code is available from Exploit-DB.

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to test files in the Amelia plugin directory.
• Look for error messages containing file paths in HTTP responses.
• Use WAF rules to block requests containing common test file patterns.

Defense:

• Immediately remove or disable test files in production.
• Set display_errors = Off in php.ini or via .htaccess:

  php_flag display_errors off
  

• Use a security plugin to block direct access to plugin directories.
• Apply the principle of least privilege to file permissions.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/amelia/vendor/symfony/.../test.php
• HTTP Requests: GET/POST requests to paths containing amelia/vendor/symfony and test.php.
• Response Patterns: Error messages containing /var/www/html or similar absolute paths.
• Log Entries: PHP warning/error logs showing file paths from the Amelia plugin directory.

Detection Engineering

YARA Rule

rule CVE_2024_6552_Amelia_Path_Disclosure {
    meta:
        description = "Detects requests to Amelia plugin test files that may cause path disclosure"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-6552"
    strings:
        $test_file = "amelia/vendor/symfony" nocase
        $test_suffix = "test.php" nocase
        $error_pattern = "Warning:" nocase
    condition:
        $test_file and $test_suffix and $error_pattern
}

Sigma Rule

title: CVE-2024-6552 Amelia Plugin Path Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Amelia plugin test files that may disclose full paths
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: 
            - '/wp-content/plugins/amelia/vendor/symfony'
            - 'test.php'
    condition: selection
falsepositives:
    - Legitimate testing by administrators
level: medium

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2024-6552 Amelia Plugin Path Disclosure Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/amelia/vendor/symfony"; http_uri;
    content:"test.php"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable display_errors in PHP configuration:
   • Edit php.ini and set display_errors = Off.
   • Or add to .htaccess: php_flag display_errors off
2. Remove test files from the production server:

   rm -rf /path/to/wp-content/plugins/amelia/vendor/symfony/*/Tests/
   

3. Restrict access to plugin directories via .htaccess:

   <Directory "/path/to/wp-content/plugins/amelia">
       Order Deny,Allow
       Deny from all
   </Directory>
   

Long-term Fix:

• Wait for an official patch from the plugin vendor (Amelia).
• Consider switching to an alternative booking plugin if no patch is released.
• Implement a Web Application Firewall (WAF) to block path disclosure attempts.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.