CVE-2021-24209: WP Super Cache RCE Vulnerability

CVE-2021-24209 Overview

CVE-2021-24209 is an authenticated Remote Code Execution (RCE) vulnerability affecting the WP Super Cache WordPress plugin before version 1.7.2. The vulnerability exists in the settings page due to inadequate input validation and a weak $cache_path check in the WP Super Cache Settings -> Cache Location option. Because direct access to the wp-cache-config.php file is not prohibited, attackers with administrative privileges can exploit this flaw to inject a web shell, gaining persistent remote code execution on the affected WordPress installation.

Critical Impact

Authenticated administrators can achieve remote code execution by injecting malicious PHP code into the cache configuration file, potentially compromising the entire WordPress installation and underlying server.

Affected Products

• Automattic WP Super Cache versions prior to 1.7.2
• WordPress installations running vulnerable WP Super Cache plugin

Discovery Timeline

• 2021-04-05 - CVE CVE-2021-24209 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-24209

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code / Code Injection). The flaw stems from the plugin's failure to properly validate and sanitize user input in the Cache Location settings field. When an authenticated administrator modifies the cache path setting, the plugin writes this value to the wp-cache-config.php configuration file without adequate security checks.

The weak $cache_path validation allows an attacker to craft a malicious input that, when written to the configuration file, results in executable PHP code being stored on the server. Since the wp-cache-config.php file is directly accessible and not protected from execution, any injected PHP code will be executed when the file is accessed, effectively creating a web shell.

This vulnerability requires administrative-level authentication to exploit, which limits the attack surface but still presents significant risk in scenarios involving compromised admin credentials, insider threats, or privilege escalation chains.

Root Cause

The root cause is twofold: insufficient input validation on the Cache Location option field and the lack of access restrictions on the wp-cache-config.php file. The plugin fails to properly sanitize special characters and PHP syntax from user-supplied input before writing it to the configuration file. Additionally, the configuration file remains directly accessible via web requests, allowing injected code to execute.

Attack Vector

The attack vector is network-based and requires an authenticated administrator session. An attacker must first gain access to a WordPress administrator account, then navigate to the WP Super Cache Settings page. By manipulating the Cache Location field with specially crafted input containing PHP code, the malicious payload is written to wp-cache-config.php. The attacker can then directly access this file via a web request to trigger execution of the injected code, establishing a web shell for persistent access and arbitrary command execution.

The vulnerability does not require user interaction beyond the attacker's own actions and can be exploited with low complexity once administrative access is obtained. The impact includes complete confidentiality, integrity, and availability compromise of the affected system.

Detection Methods for CVE-2021-24209

Indicators of Compromise

• Unexpected modifications to wp-cache-config.php file, especially containing PHP code execution functions such as eval(), exec(), system(), or passthru()
• Unusual HTTP requests directly accessing wp-cache-config.php from external IP addresses
• Presence of web shell artifacts or suspicious PHP files in the cache directory
• Unexpected administrative activity or changes to WP Super Cache settings

Detection Strategies

• Monitor WordPress admin panel access logs for suspicious activity in WP Super Cache settings pages
• Implement file integrity monitoring (FIM) on critical WordPress files including wp-cache-config.php
• Utilize web application firewalls (WAF) with rules to detect PHP code injection patterns in POST requests
• Review server access logs for direct requests to configuration files that should not be accessed directly

Monitoring Recommendations

• Enable audit logging for all WordPress administrative actions and plugin configuration changes
• Configure alerts for file modifications in WordPress plugin directories
• Monitor for outbound network connections from the web server that may indicate reverse shell activity
• Implement SentinelOne endpoint detection for real-time monitoring of suspicious process execution and file system changes

How to Mitigate CVE-2021-24209

Immediate Actions Required

• Update WP Super Cache to version 1.7.2 or later immediately
• Audit all WordPress administrator accounts and revoke any compromised or unnecessary admin access
• Review wp-cache-config.php for signs of tampering or injected code
• Implement strong authentication measures including multi-factor authentication for all admin accounts

Patch Information

Automattic has addressed this vulnerability in WP Super Cache version 1.7.2. The patch improves input validation for the Cache Location option and strengthens the $cache_path security checks. Users should update to the latest version through the WordPress plugin update mechanism. The specific code changes can be reviewed in the WordPress Plugin Change Log. Additional vulnerability details are available in the WPScan Vulnerability Report.

Workarounds

• Restrict access to the WordPress admin panel to trusted IP addresses only using .htaccess or server-level firewall rules
• Add server configuration to prevent direct access to wp-cache-config.php via web requests
• Temporarily disable the WP Super Cache plugin until the update can be applied
• Implement file permission restrictions to make configuration files read-only where possible

# Block direct access to wp-cache-config.php via .htaccess
<Files "wp-cache-config.php">
    Order Allow,Deny
    Deny from all
</Files>