CVE-2024-9162

Executive Summary

CVE-2024-9162 is a critical vulnerability in the All-in-One WP Migration and Backup plugin for WordPress, affecting all versions up to and including 7.86. The flaw allows authenticated attackers with Administrator-level access to inject arbitrary PHP code into exported backup files. Due to missing file type validation during the export process, an attacker can create a .php file on the server containing malicious code, leading to Remote Code Execution (RCE). This vulnerability is particularly dangerous in multi-site WordPress environments or where admin accounts are compromised. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public availability of PoC details increases risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who install the plugin from the repository or via automatic updates are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Administrators should verify the integrity of plugin files and monitor for unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the severe impact of RCE, though the requirement for admin privileges reduces the attack surface. However, in shared hosting or multi-tenant environments, a compromised admin account can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the export functionality of the All-in-One WP Migration plugin. When an administrator initiates a backup export, the plugin creates a file on the server. The file extension is derived from the export type, but due to insufficient validation, an attacker can manipulate the export process to produce a file with a .php extension instead of the expected .wpress or .zip. The exported content includes serialized WordPress data, but an attacker can inject arbitrary PHP code into the export data (e.g., via a crafted post or option value). When the .php file is accessed via the web server, the injected PHP code executes, allowing the attacker to run system commands, read sensitive files, or establish persistence.

The missing file type validation occurs in the plugin's export handler, where the filename is constructed without sanitizing the extension. The plugin uses pathinfo() to determine the extension but does not restrict it to allowed types. An attacker can craft a request that sets the filename to malicious.php, and the plugin will write the export data to that file.

Vulnerable vs. Patched Code

Vulnerable Code (<= 7.86): The export function in lib/model/class-ai1wm-export.php or similar constructs the filename using user-supplied parameters without validation:

$filename = $params['filename'] . '.' . $params['extension'];
// No check on $params['extension'] against allowed list
file_put_contents($filename, $export_data);

Patched Code (Hypothetical): A patch would validate the extension against a whitelist:

$allowed_extensions = array('wpress', 'zip', 'tar.gz');
if (!in_array($params['extension'], $allowed_extensions)) {
    throw new Exception('Invalid file extension');
}
$filename = sanitize_file_name($params['filename']) . '.' . $params['extension'];
file_put_contents($filename, $export_data);

Since no official patch is available, users must implement mitigations manually.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid WordPress admin credentials.
• Access to the WordPress admin dashboard.

Steps:

1. Log in as an administrator.
2. Navigate to All-in-One WP Migration > Export.
3. Intercept the export request using a proxy (e.g., Burp Suite).
4. Modify the filename parameter to include a .php extension and inject PHP code into the export data (e.g., via a crafted post).
5. Submit the request. The plugin creates a file like shell.php in the uploads directory.
6. Access the file via http://target/wp-content/uploads/shell.php to execute the injected code.

Example Payload: In the export data, inject:

<?php system($_GET['cmd']); ?>

Then access http://target/wp-content/uploads/shell.php?cmd=id.

Blue Team (Detection & Prevention)

Detection:

• Monitor for export requests with unusual file extensions (e.g., .php, .phtml).
• Alert on creation of .php files in the WordPress uploads directory outside of normal media uploads.
• Use file integrity monitoring to detect new PHP files in unexpected locations.

Prevention:

• Restrict admin access to trusted users only.
• Implement Web Application Firewall (WAF) rules to block export requests with non-standard extensions.
• Disable the plugin if not essential, or apply virtual patching via a WAF.

Indicators of Compromise (IOCs)

• File: wp-content/uploads/ai1wm-backups/*.php (any PHP file in the backup directory)
• Network: HTTP requests to /wp-admin/admin-ajax.php?action=ai1wm_export with modified filename parameter containing .php
• Logs: WordPress debug logs showing unexpected PHP files in uploads
• Process: Unusual PHP processes spawned from the web server user

Detection Engineering

YARA Rule

rule CVE_2024_9162_Export_Php {
    meta:
        description = "Detects PHP files created by All-in-One WP Migration export with .php extension"
        author = "Valters IT"
        date = "2024-10-01"
        reference = "CVE-2024-9162"
    strings:
        $php_tag = "<?php"
        $export_marker = "ai1wm"
    condition:
        $php_tag at 0 and $export_marker and filesize < 10MB
}

Sigma Rule

title: All-in-One WP Migration Export to PHP File
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of PHP files in the AI1WM backup directory
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'wp-content/uploads/ai1wm-backups/'
        TargetFilename|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP files uploaded by admin (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9162 All-in-One WP Migration Export to PHP"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ai1wm_export"; http_client_body; content:"filename"; http_client_body; pcre:"/filename=[^&]*\.php/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the All-in-One WP Migration plugin until a patch is released.
2. Short-term: Restrict admin access to trusted users and enable multi-factor authentication.
3. Long-term: Monitor the plugin's official page for updates and apply the patch as soon as it becomes available.
4. Virtual Patching: Use a WAF to block export requests with .php extensions.
5. File Permissions: Ensure the web server cannot execute PHP files in the uploads directory (e.g., via .htaccess or Nginx config).

Valters IT
Securing Digital Frontiers