CVE-2024-7315

Executive Summary

CVE-2024-7315 is a vulnerability in the WordPress plugin Migration, Backup, Staging by Wpvivid. The plugin fails to use sufficient randomness when generating filenames for backup archives. This allows an unauthenticated attacker to brute-force the backup filename and download sensitive data, including the entire WordPress database and files. The vulnerability affects all versions prior to 0.9.106. No public proof-of-concept (PoC) code or exploit is currently available, but the attack vector is straightforward due to the weak randomness.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are affected. There is no known compromise of the plugin's supply chain; the weakness is in the plugin's own code.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack can be performed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required; the backup filename pattern is predictable.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database and file disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)
Threat Level: High – The attack is easy to execute and can lead to complete data breach.

Deep Dive & Mechanics

The plugin creates backup files (e.g., .zip or .sql) in a publicly accessible directory (typically /wp-content/uploads/wpvividbackup/). The filename is generated using a weak random function, such as mt_rand() or a timestamp-based seed, making it predictable. An attacker can enumerate possible filenames by iterating through a small keyspace (e.g., 1 million possibilities) and checking HTTP response codes (200 vs 404). Once a valid backup file is found, it can be downloaded directly, exposing the entire WordPress database, user credentials, and uploaded files.

The vulnerability is classified as CWE-330: Use of Insufficiently Random Values. The plugin does not use a cryptographically secure pseudo-random number generator (CSPRNG) like random_bytes() or openssl_random_pseudo_bytes().

Vulnerable vs. Patched Code

Vulnerable (before 0.9.106):

// Weak randomness using mt_rand()
$backup_filename = 'wpvivid-backup-' . mt_rand(100000, 999999) . '.zip';

Patched (0.9.106 and later):

// Strong randomness using random_bytes()
$backup_filename = 'wpvivid-backup-' . bin2hex(random_bytes(16)) . '.zip';

The patched version uses random_bytes() to generate a 32-character hex string, making brute-force attacks infeasible.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Install a vulnerable version of the plugin (e.g., 0.9.105) on a WordPress site.
2. Trigger Backup: Log in as admin and create a backup via the plugin's interface.
3. Enumerate Filenames: Use a script to brute-force the backup filename. Example Python script:

import requests

base_url = "http://target/wp-content/uploads/wpvividbackup/"
for i in range(100000, 999999):
    url = f"{base_url}wpvivid-backup-{i}.zip"
    r = requests.get(url)
    if r.status_code == 200:
        print(f"Found: {url}")
        break

4. Download Backup: Once found, download the file to extract sensitive data.

Blue Team (Defense & Detection)

• Monitor Access Logs: Look for repeated 404/200 requests to /wp-content/uploads/wpvividbackup/ with sequential filenames.
• Rate Limiting: Implement WAF rules to block rapid requests to the backup directory.
• File Integrity Monitoring: Alert on creation of backup files in the uploads directory.
• Update Plugin: Immediately upgrade to version 0.9.106 or later.

Indicators of Compromise (IOCs)

• File Path: /wp-content/uploads/wpvividbackup/wpvivid-backup-*.zip
• HTTP Requests: GET requests to the above path with sequential or predictable patterns.
• Log Entries: Multiple 404 errors followed by a 200 for a backup file.
• Network Traffic: Outbound data transfer of large .zip files from the server.

Detection Engineering

YARA Rule

rule wpvivid_backup_leak {
    meta:
        description = "Detects weak backup filenames from Wpvivid plugin"
        author = "Valters IT"
        date = "2024-08-01"
        hash = "unknown"
    strings:
        $weak_pattern = /wpvivid-backup-\d{6}\.zip/
    condition:
        $weak_pattern
}

Sigma Rule

title: Wpvivid Backup Filename Brute Force
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects brute-force attempts on Wpvivid backup filenames
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: '/wp-content/uploads/wpvividbackup/wpvivid-backup-'
        sc-status: 404
    condition: selection | count() > 100 within 5 minutes
falsepositives:
    - Legitimate backup downloads
level: high

Suricata Rule

alert http any any -> any any (
    msg:"Wpvivid Backup Filename Brute Force";
    flow:to_server;
    content:"/wp-content/uploads/wpvividbackup/wpvivid-backup-";
    http_uri;
    pcre:"/wpvivid-backup-\d{6}\.zip/";
    threshold: type both, track by_src, count 100, seconds 300;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Upgrade the plugin to version 0.9.106 or later.
2. Workaround: If upgrade is not possible, restrict access to the /wp-content/uploads/wpvividbackup/ directory via .htaccess:

   <Directory "/wp-content/uploads/wpvividbackup/">
       Require all denied
   </Directory>
   

3. Long-term: Ensure all WordPress plugins use CSPRNG for generating sensitive filenames.
4. Monitoring: Implement the detection rules above to identify exploitation attempts.

Valters IT
Securing Digital Frontiers