CVE-2024-8699

Executive Summary

CVE-2024-8699 is a critical vulnerability in the Z-Downloads WordPress plugin (versions before 1.11.5) that allows high-privilege users (e.g., administrators) to upload arbitrary files to the server. This flaw bypasses intended file type restrictions, particularly in multisite WordPress configurations where site administrators should not have the ability to upload executable files. Successful exploitation could lead to remote code execution (RCE), full site takeover, or lateral movement within a multisite network.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users should verify they are running version 1.11.5 or later. No known supply chain compromise has been reported, but the risk of malicious plugin updates or backdoored versions exists if the plugin's update mechanism is compromised.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the vulnerability mechanics, a realistic score is 8.8 (High).
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: High – Exploitation requires admin credentials, but in multisite environments, site admins can compromise the entire network.

Deep Dive & Mechanics

The vulnerability resides in the file upload handling logic of the Z-Downloads plugin. The plugin fails to properly validate the MIME type and file extension of uploaded files. In a standard WordPress installation, administrators have full control, but in multisite setups, site administrators should be restricted from uploading executable files (e.g., PHP, .htaccess). The plugin does not enforce these restrictions, allowing an authenticated admin to upload a malicious PHP file to the server.

Root Cause: The plugin uses wp_handle_upload() without additional validation or uses a custom upload handler that does not check for allowed file types based on user role or multisite context.

Attack Flow:

1. Attacker gains admin access to a WordPress site (e.g., via stolen credentials or social engineering).
2. Attacker navigates to the Z-Downloads upload interface.
3. Attacker uploads a PHP web shell disguised as a legitimate file (e.g., shell.php.jpg).
4. The plugin saves the file to the WordPress uploads directory.
5. Attacker accesses the uploaded file directly via URL, executing arbitrary PHP code.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.11.5):

// In z-downloads.php or similar
function zd_handle_upload($file) {
    $upload = wp_handle_upload($file, array('test_form' => false));
    // No additional validation for file type or user role
    return $upload;
}

Patched Code (1.11.5):

function zd_handle_upload($file) {
    // Check user capabilities
    if (!current_user_can('upload_files') || (is_multisite() && !is_super_admin())) {
        return new WP_Error('upload_error', 'You do not have permission to upload files.');
    }
    // Validate file type
    $allowed_types = array('zip', 'pdf', 'doc', 'docx');
    $file_ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($file_ext), $allowed_types)) {
        return new WP_Error('upload_error', 'File type not allowed.');
    }
    $upload = wp_handle_upload($file, array('test_form' => false));
    return $upload;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials to a WordPress site with Z-Downloads < 1.11.5.
• Access to the Z-Downloads upload page (typically /wp-admin/admin.php?page=z-downloads).

Exploit Steps:

1. Log in as an admin.
2. Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Rename the file to bypass extension checks (e.g., shell.php.jpg).
4. Upload the file via the Z-Downloads interface.
5. Locate the uploaded file URL (e.g., /wp-content/uploads/z-downloads/shell.php.jpg).
6. Execute commands: https://target.com/wp-content/uploads/z-downloads/shell.php.jpg?cmd=id

Alternative Payload: Use a polyglot file (e.g., PHP code embedded in a valid image) to evade basic checks.

Blue Team

Detection:

• Monitor for unusual file uploads in /wp-content/uploads/z-downloads/.
• Alert on PHP files uploaded by non-super-admin users in multisite.
• Use file integrity monitoring (FIM) to detect new PHP files in uploads.

Hunting:

• Search for files with double extensions (e.g., .php.jpg, .php.png) in the uploads directory.
• Review access logs for direct access to uploaded files with query parameters (e.g., ?cmd=).

Lab Setup:

1. Install WordPress with multisite enabled.
2. Install Z-Downloads version 1.11.4.
3. Create a site admin account (not super admin).
4. Attempt to upload a PHP file via the plugin.
5. Verify the file is accessible and executable.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/z-downloads/*.php
  • /wp-content/uploads/z-downloads/*.php.jpg
• Network Traffic:
  • HTTP POST requests to /wp-admin/admin-ajax.php with file upload parameters.
  • GET requests to /wp-content/uploads/z-downloads/*.php?cmd=...
• Log Entries:
  • WordPress debug log: PHP Warning: file_put_contents(...)
  • Web server access log: POST /wp-admin/admin-ajax.php HTTP/1.1 with large payloads.
• File Hashes (example):
  • shell.php.jpg – MD5: d41d8cd98f00b204e9800998ecf8427e (placeholder)

Detection Engineering

YARA Rule

rule CVE_2024_8699_Z_Downloads_Upload {
    meta:
        description = "Detects PHP files uploaded via Z-Downloads plugin"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-8699"
    strings:
        $php_tag = "<?php"
        $z_downloads_path = "/z-downloads/"
    condition:
        $php_tag and $z_downloads_path
}

Sigma Rule

title: CVE-2024-8699 - Z-Downloads Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects file uploads to Z-Downloads plugin directory with PHP extensions
author: Valters IT
date: 2025-04-14
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: '\\wp-content\\uploads\\z-downloads\\'
        TargetFilename|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate plugin updates (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8699 Z-Downloads PHP Upload"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"filename="; http_client_body; pcre:"/\.php/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Update Z-Downloads to version 1.11.5 or later.
2. If unable to update, disable the plugin until patched.
3. Review all uploaded files in /wp-content/uploads/z-downloads/ for malicious content.

Long-term:

• Implement a Web Application Firewall (WAF) rule to block PHP file uploads to plugin directories.
• Enforce strict file type validation on all upload endpoints.
• In multisite, restrict file upload capabilities for site administrators using custom code or a security plugin.
• Regularly audit user permissions and uploaded files.

Workaround:

• Add the following to .htaccess in the uploads directory to block PHP execution:

  <FilesMatch "\.php$">
      Require all denied
  </FilesMatch>
  

Valters IT