CVE-2024-6560

Executive Summary

CVE-2024-6560 is a Full Path Disclosure vulnerability in the Addonify – Quick View For WooCommerce WordPress plugin, affecting all versions up to and including 1.2.16. The vulnerability arises because the plugin includes the mobiledetect library without restricting direct access to its files. An unauthenticated attacker can trigger a PHP error that reveals the server’s absolute filesystem path. While this information alone is not directly exploitable, it significantly aids in reconnaissance for further attacks, such as SQL injection or local file inclusion. The CVSS score is 5.3 (Medium), and no public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Only the filesystem path is disclosed.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No service disruption.

Threat Level: Medium. The information leak is a stepping stone for more severe attacks.

Deep Dive & Mechanics

The Addonify – Quick View For WooCommerce plugin bundles the mobiledetect library (a PHP class for detecting mobile devices). The library’s files are included via require_once or similar statements. However, the plugin does not prevent direct HTTP access to these library files. When an attacker requests a library file directly (e.g., /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php), PHP may generate a fatal error or warning that includes the full server path in the error message. This occurs because the library file expects to be included in a specific context and fails when accessed standalone.

The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The disclosed path (e.g., /var/www/html/wp-content/plugins/...) can be used to map the server’s directory structure, aiding in attacks like path traversal or file inclusion.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.2.16): The plugin includes the mobiledetect library without any access control. For example, in class-addonify-quick-view.php:

require_once plugin_dir_path( __FILE__ ) . 'vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php';

Direct access to this file is not blocked.

Patched Code (hypothetical): A patch would add a check to prevent direct access:

if ( ! defined( 'ABSPATH' ) ) {
    exit; // Exit if accessed directly.
}
require_once plugin_dir_path( __FILE__ ) . 'vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php';

Alternatively, the library could be loaded only when needed, and error reporting could be suppressed for direct requests.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Addonify Quick View plugin version <= 1.2.16.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable plugin path. Common paths include:
   • /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php
   • /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/MobileDetect.php
2. Send a GET request to one of these paths using a tool like curl:

   curl -v "http://target.com/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php"
   

3. Observe the response. If PHP error display is enabled, the response will contain the full server path, e.g.:

   Warning: require_once(/var/www/html/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php): failed to open stream: No such file or directory in /var/www/html/wp-content/plugins/addonify-quick-view/class-addonify-quick-view.php on line 10
   

4. Extract the path from the error message.

Note: If error display is disabled, the vulnerability may not be exploitable. However, the path may still be leaked in other ways (e.g., via debug logs).

Blue Team

Detection:

• Monitor web server logs for requests to plugin vendor files, especially those containing mobiledetect.
• Look for 500 Internal Server Error responses or PHP warnings in logs.

Mitigation:

• Disable PHP error display in production (display_errors = Off in php.ini).
• Use a Web Application Firewall (WAF) to block direct access to plugin vendor directories.
• Apply the principle of least privilege: ensure the web server cannot write to plugin directories.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php
  • /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/MobileDetect.php
• Log Patterns:
  • GET /wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/
  • PHP error messages containing the server’s absolute path.
• Network Indicators:
  • Outbound requests from the server to attacker-controlled hosts (if the path is used in further attacks).

Detection Engineering

YARA Rule

rule CVE_2024_6560_Addonify_Full_Path_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2024-6560 in Addonify Quick View plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-6560"
    strings:
        $path1 = "/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php"
        $path2 = "/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/MobileDetect.php"
        $error = "Warning: require_once("
    condition:
        any of ($path*) and $error
}

Sigma Rule

title: CVE-2024-6560 Addonify Full Path Disclosure Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting Addonify Quick View plugin vendor files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains:
            - '/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/namespaced/MobileDetect.php'
            - '/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/MobileDetect.php'
    condition: selection
falsepositives:
    - Legitimate plugin updates or scans
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-6560 Addonify Full Path Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/wp-content/plugins/addonify-quick-view/vendor/mobiledetect/mobiledetectlib/"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable PHP error display in production (display_errors = Off in php.ini).
2. Block direct access to plugin vendor directories via .htaccess:

   <Directory "/wp-content/plugins/addonify-quick-view/vendor/">
       Require all denied
   </Directory>
   

3. Update the plugin if a patched version becomes available. Monitor the WordPress plugin repository for updates.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block requests to known vulnerable paths.
• Conduct regular vulnerability scans of WordPress plugins.
• Follow the principle of least privilege for file permissions.

Patch Status: As of this report, no official patch has been released. The vendor (Addonify) should be contacted for a fix.

Valters IT