CVE-2024-7411

Executive Summary

CVE-2024-7411 is a Full Path Disclosure vulnerability in the Tribulant Newsletters plugin for WordPress, affecting all versions up to and including 4.9.9. The vulnerability allows unauthenticated remote attackers to retrieve absolute filesystem paths of the web application by directly accessing a specific PHP file within the bundled MobileDetect library. While the information disclosed is not directly exploitable, it serves as a valuable reconnaissance stepping stone for attackers, significantly reducing the effort required to exploit other vulnerabilities on the target host.

Technical Analysis

The vulnerability originates from an oversight in the Tribulant Newsletters plugin, which bundles the MobileDetect PHP library under the /vendor/mobiledetect/mobiledetectlib/ directory. Specifically, the file export/exportToJSON.php is included with the package and is directly accessible via HTTP.

When an unauthenticated user sends a direct HTTP request to https://target.com/wp-content/plugins/newsletters/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php, the PHP script executes. The script contains logic that attempts to derive and display filesystem paths relative to the document root. Due to the lack of an access control check (no capability check, no defined('ABSPATH') guard, no nonce verification), the script executes in its raw form.

The PHP script's functionality is designed to export MobileDetect cache data to a JSON file for offline processing. During execution, it emits absolute filesystem paths, including:

• The server's document root (e.g., /var/www/html)
• The absolute path to the wp-content directory
• The plugin's installation path (e.g., /var/www/html/wp-content/plugins/newsletters/)

The script does not require authentication, does not check for WordPress bootstrap constants, and does not validate the HTTP request method. Any GET request triggers the path disclosure. The output may be rendered in the HTTP response body, in error messages (if display_errors is enabled), or in the generated JSON export file if the server's web root is within the reachable path.

Attack surface: Unauthenticated HTTP GET request. No special headers, cookies, or parameters are required. The attack is trivial to automate and requires no user interaction.

Code-level explanation: The vulnerable file likely contains logic similar to:

<?php
// exportToJSON.php
$exportPath = __DIR__ . '/export.json';
file_put_contents($exportPath, json_encode($detectionCache));
echo "Export completed to " . realpath($exportPath) . "\n";

The use of realpath(), __DIR__, or direct concatenation of file paths in echo statements reveals the absolute path to the attacker.

Exploitation Scenarios

Preconditions: Target runs WordPress with the Tribulant Newsletters plugin version ≤ 4.9.9 installed and activated. The plugin's /vendor/ directory must be web-accessible (default for most Apache/Nginx misconfigurations).

Step-by-step attack chain:

1. Reconnaissance: The attacker identifies the target WordPress site. Using tools such as WPScan or by fetching /wp-content/plugins/newsletters/readme.txt, they confirm the plugin name and version.

2. Direct request: The attacker sends an unauthenticated GET request:

   GET /wp-content/plugins/newsletters/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php HTTP/1.1
   Host: target.com
   

   Using curl:

   curl -v "https://target.com/wp-content/plugins/newsletters/vendor/mobiledetect/mobiledetectlib/export/exportToJSON.php"
   

3. Response analysis: The HTTP response body or server headers contain the absolute filesystem path. For example, the response may include:

   Export successful. File written to /var/www/html/wp-content/plugins/newsletters/vendor/mobiledetect/mobiledetectlib/export/cache.json
   

   Or a PHP warning/error may leak the path:

   Warning: file_put_contents(/var/www/html/wp-content/plugins/newsletters/...): failed to open stream: Permission denied in ...
   

4. Post-exploitation data collection: The attacker records the absolute path. This reveals:

   • Server OS family and directory structure (e.g., /var/www/ implies Debian/Ubuntu; C:\inetpub\ implies Windows/IIS).
   • Web server software and virtual host configuration.

5. Secondary targeting: Using the leaked path, the attacker crafts more precise exploit attempts for other known WordPress plugin vulnerabilities:

   • Local File Inclusion (LFI): Traversing from the known web root with ../../... patterns.
   • SQL Injection: Crafting UNION-based payloads that write to relative paths.
   • Log poisoning: Identifying the exact log file location (e.g., /var/log/apache2/access.log) for injecting PHP code.
   • Directory traversal: If the path reveals a non-standard layout (e.g., /home/user/public_html), the attacker can infer privilege escalation targets.

6. Automation: The attacker mass-scans the internet using search engines (Google dork: inurl:"exportToJSON.php"), Shodan (http.html:"wp-content/plugins/newsletters"), or Nuclei templates to harvest vulnerable hosts in bulk.

Impact: While the path disclosure alone yields Medium severity (CVSS 5.3), it enables a chain of attacks that can lead to Remote Code Execution if combined with file-write or LFI vulnerabilities on the same host.

Impact Assessment

CVSS Analysis: The vulnerability scores 5.3 (Medium) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Key factors:

• Attack Vector: Network — remotely exploitable.
• Attack Complexity: Low — no special conditions beyond default installation.
• Privileges Required: None — unauthenticated.
• User Interaction: None — fully automated attack.
• Confidentiality Impact: Low — reads a single filesystem path string.

Business Impact:

• Information Disclosure: The absolute path reveals the hosting environment, aiding targeted attacks.
• Reconnaissance Accelerator: Attackers probing a site for high-severity vulnerabilities gain a head start.
• Compliance Risk: For organizations under PCI-DSS, HIPAA, or GDPR, unauthorized path disclosure may be considered a breach of "least privilege" and could be reportable in security audits.

Affected Systems: Any WordPress installation with the Tribulant Newsletters plugin ≤ 4.9.9. The plugin is used for email newsletter management, commonly found on small-to-medium business marketing sites, blogs, and e-commerce stores.

Blast Radius: The direct impact is limited to one leaked path string. However, the downstream impact on a contaminated WordPress host can be critical. Given that WordPress powers ~43% of websites and this plugin has an active install base in the tens of thousands, the potential blast radius is substantial.

Detection Guidance

Sigma Rule

title: Wordpress Newsletters Plugin Full Path Disclosure Attempt
id: 5b8f7a3e-2c4d-4e6f-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects direct access to the MobileDetect exportToJSON.php file in the Wordpress Newsletters plugin, indicating an attempt to exploit CVE-2024-7411.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-7411
date: 2024/12/01
tags:
    - attack.t1190
    - attack.initial_access
    - cve.2024.7411
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs'
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains|all:
            - 'wp-content/plugins/newsletters'
            - 'mobiledetect'
            - 'exportToJSON.php'
    condition: selection
fields:
    - c-uri
    - c-ip
    - sc-status
falsepositives:
    - Legitimate admin accessing the export feature (rare, requires no auth)
level: medium

YARA Rule

rule Wordpress_Newsletters_Path_Disclosure_CVE_2024_7411
{
    meta:
        author = "Valtersit Threat Intel Team"
        description = "Detects exploit attempts for CVE-2024-7411 in web logs"
        date = "2024-12-01"
        cve = "CVE-2024-7411"
        severity = "medium"
    strings:
        $a = "wp-content/plugins/newsletters" ascii wide
        $b = "mobiledetectlib" ascii wide
        $c = "exportToJSON.php" ascii wide
        $d = "/vendor/" ascii wide
    condition:
        all of them
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2024-7411 WordPress Newsletters Full Path Disclosure Attempt";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/wp-content/plugins/newsletters/";
    http.uri; content:"mobiledetect"; distance:0;
    http.uri; content:"exportToJSON.php"; distance:0; within:30;
    classtype:attempted-recon;
    sid:20247411;
    rev:1;
    metadata:created_at 2024_12_01, updated_at 2024_12_01;
)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where event.type == "connection" and destination.port == 80
  ] by destination.ip
  [ http where event.category == "web" and http.request.method == "GET" and
    url.path like~ "*/wp-content/plugins/newsletters/*" and
    url.path like~ "*mobiledetect*" and
    url.path like~ "*exportToJSON.php" and
    not source.ip in ("127.0.0.1", "::1")
  ] by source.ip

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%wp-content/plugins/newsletters%") 
  AND like(uri_path, "%mobiledetect%") 
  AND like(uri_path, "%exportToJSON.php%")
  AND http_method="GET"
| stats count by src_ip, uri_path, status
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,">
    <rule id="100411" level="8">
        <decoded_as>json</decoded_as>
        <field name="url">\.wp-content/plugins/newsletters/.*mobiledetect.*exportToJSON\.php</field>
        <description>Attempt to exploit CVE-2024-7411 - WordPress Newsletters Full Path Disclosure</description>
        <group>wordpress,reconnaissance,cve-2024-7411,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED. A single source claims the vendor has released a patch in version 4.9.9.1 or later. This has NOT been independently confirmed. Treat the patch as provisional until verified from the official plugin repository.

Immediate Mitigations (no patch verification required):

1. Block file access at the WAF level: Deploy a Web Application Firewall (e.g., Cloudflare, AWS WAF, ModSecurity) with a rule blocking any request containing exportToJSON.php in the URI.
2. Filesystem permission hardening: Ensure the web server user does not have write access to the plugin directory (/wp-content/plugins/newsletters/). Set chmod -R 555 on the plugin directory to prevent script execution side-effects, though this will not stop path leakage.
3. Disable display_errors: Set display_errors = Off in php.ini. This will suppress error messages that embed absolute paths.
4. Remove the vulnerable file: If the plugin is not actively used, delete the entire /vendor/mobiledetect/ directory. If the plugin must remain active, manually delete export/exportToJSON.php — this will not break core email functionality but may break MobileDetect export features (unlikely to be used in production).

Patch/Upgrade Steps:

1. Verify patch availability by checking the WordPress plugin repository: https://wordpress.org/plugins/newsletters/
2. Update the plugin to version 4.9.9.1 or the latest version via the WordPress admin dashboard → Plugins → Update.
3. If the update is not yet available via the repository, download the latest package and manually override the plugin files via FTP/SSH.
4. After updating, verify the fix by attempting to access the exportToJSON.php endpoint — it should return a 403 or 404 error.

Long-Term Hardening:

1. Enforce a policy of automated plugin update notifications.
2. Use a WordPress security scanner (e.g., WPScan) in CI/CD to catch known CVEs in plugins before deployment.
3. Implement a Web Application Firewall rule set that blocks direct access to /vendor/ paths across all plugins — this is a common weakness pattern.
4. Conduct quarterly WordPress vulnerability audits of all installed plugins.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-7411
2. WordPress Plugin Repository (Newsletters): https://wordpress.org/plugins/newsletters/
3. WordPress Plugin Vulnerability Database (WPScan): https://wpscan.com/plugin/newsletters/
4. MobileDetect Library Repository: https://github.com/serbanghita/Mobile-Detect
5. Exploit-DB / Packet Storm search for related advisories: https://www.exploit-db.com/search?q=CVE-2024-7411

Threat Actor Activity: As of the writing date, no state-sponsored or financially motivated threat actor campaigns have been publicly attributed to exploiting CVE-2024-7411 in the wild. The vulnerability's low direct impact (path disclosure only) makes it unlikely to be targeted in isolation. However, it may be used as a pre-exploitation step in automated WordPress mass-scanning botnets that chain multiple low-severity flaws for reconnaissance. No entries exist in CISA's Known Exploited Vulnerabilities (KEV) catalog at this time.