CVE-2024-9939

Executive Summary

CVE-2024-9939 is a critical Path Traversal vulnerability in the WordPress File Upload plugin (vendor: Ip2location) affecting all versions up to and including 4.24.13. The flaw resides in the wfu_file_downloader.php file, allowing unauthenticated attackers to read arbitrary files outside the intended directory. This can lead to exposure of sensitive data such as wp-config.php, database credentials, and other server files. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched. No public exploit code or PoC has been released, but the risk is significant due to the plugin's widespread use in the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is not an NPM, PyPI, Go, or Ruby package. Users should monitor the plugin's repository for patches and consider temporary removal if no update is available.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for any site using the affected plugin.

Deep Dive & Mechanics

The vulnerability exists in the wfu_file_downloader.php script, which handles file download requests. The script fails to properly sanitize user-supplied input used to construct file paths. By manipulating parameters such as file or path, an attacker can traverse directories using ../ sequences to access files outside the intended upload directory.

Root Cause: The application does not validate or restrict the file path to the intended base directory, allowing path traversal.

Attack Vector: An unauthenticated HTTP GET request to the vulnerable endpoint with a crafted file parameter.

Example Request:

GET /wp-content/plugins/wp-file-upload/wfu_file_downloader.php?file=../../../wp-config.php HTTP/1.1
Host: target-site.com

This would return the contents of wp-config.php, exposing database credentials and other sensitive configuration.

Vulnerable vs. Patched Code

Vulnerable Code (wfu_file_downloader.php):

$file = $_GET['file'];
$file_path = $upload_dir . '/' . $file;
if (file_exists($file_path)) {
    readfile($file_path);
}

Patched Code (Hypothetical):

$file = basename($_GET['file']);
$file_path = realpath($upload_dir . '/' . $file);
if (strpos($file_path, realpath($upload_dir)) === 0 && file_exists($file_path)) {
    readfile($file_path);
}

The patched version uses basename() to strip directory components and realpath() to resolve the full path, then checks that the resolved path starts with the intended base directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with the vulnerable plugin (version 4.24.13).
2. Ensure the plugin is active and accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint: /wp-content/plugins/wp-file-upload/wfu_file_downloader.php.
2. Craft a request to read sensitive files:

   curl "http://target/wp-content/plugins/wp-file-upload/wfu_file_downloader.php?file=../../../wp-config.php"
   

3. Extract database credentials and other secrets from the response.

Automated Scanning: Use Nuclei with a custom template (if available) or manually test with Burp Suite.

Blue Team

Detection:

• Monitor web server logs for requests containing wfu_file_downloader.php with ../ patterns.
• Look for unusual file paths in GET parameters.

Hunting:

• Search for wfu_file_downloader.php in access logs.
• Correlate with known IoCs.

Containment:

• Immediately disable or remove the plugin if no patch is available.
• Implement a WAF rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/wp-file-upload/wfu_file_downloader.php
• URL Patterns: wfu_file_downloader.php?file=../ or wfu_file_downloader.php?file=..%2f
• Log Entries: HTTP 200 responses to wfu_file_downloader.php with suspicious parameters.
• Network Indicators: Outbound connections from the server to unknown IPs (if data exfiltration occurs).

Detection Engineering

YARA Rule

rule CVE_2024_9939_WordPress_File_Upload_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against WordPress File Upload plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9939"
    strings:
        $s1 = "wfu_file_downloader.php" nocase
        $s2 = "../" nocase
        $s3 = "..%2f" nocase
        $s4 = "wp-config.php" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-9939 WordPress File Upload Path Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the WordPress File Upload plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'wfu_file_downloader.php'
            - '../'
            - '..%2f'
    condition: selection
falsepositives:
    - Legitimate file downloads with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9939 WordPress File Upload Path Traversal"; flow:to_server,established; content:"wfu_file_downloader.php"; http_uri; content:"../"; http_uri; distance:0; content:"..%2f"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Review server logs for signs of exploitation.

Long-term Fix:

• Apply the official patch from the vendor when available.
• Upgrade to a patched version (monitor the WordPress Plugin Directory).
• Consider replacing the plugin with an alternative that is actively maintained.

Compromise Assessment:

• Check for unauthorized file reads by reviewing access logs for wfu_file_downloader.php requests.
• Rotate any credentials that may have been exposed (e.g., database passwords, API keys).

Valters IT
Securing Digital Frontiers