CVE-2024-10571: Ays-pro Chartify RCE Vulnerability

CVE-2024-10571 Overview

CVE-2024-10571 is a critical Local File Inclusion (LFI) vulnerability affecting the Chartify – WordPress Chart Plugin for WordPress. The vulnerability exists in all versions up to and including 2.9.5 and is exploitable via the source parameter. This flaw allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of any PHP code present in those files. Attackers can leverage this vulnerability to bypass access controls, obtain sensitive data, or achieve remote code execution in scenarios where images or other seemingly "safe" file types can be uploaded and subsequently included.

Critical Impact

Unauthenticated attackers can achieve arbitrary code execution on vulnerable WordPress installations by exploiting this Local File Inclusion vulnerability, potentially leading to complete site compromise, data theft, and persistent backdoor access.

Affected Products

• Chartify – WordPress Chart Plugin versions up to and including 2.9.5
• ays-pro chartify (Free WordPress plugin)

Discovery Timeline

• 2024-11-14 - CVE-2024-10571 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-10571

Vulnerability Analysis

This Local File Inclusion vulnerability stems from improper input validation in the Chartify plugin's handling of the source parameter. The plugin fails to properly sanitize user-controlled input before including files, allowing attackers to manipulate file paths and include arbitrary files from the server's filesystem.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes the specific weakness where PHP's file inclusion mechanisms are exploited due to insufficient input validation.

What makes this vulnerability particularly dangerous is that it requires no authentication to exploit. Any unauthenticated user can craft malicious requests to the vulnerable endpoint and potentially include sensitive files or achieve code execution. When combined with file upload functionality—even for supposedly safe file types like images—attackers can upload files containing PHP code and then use this LFI vulnerability to execute that code.

Root Cause

The root cause of CVE-2024-10571 is the lack of proper input sanitization and validation on the source parameter within the Chartify plugin's chart options handling functionality. The affected code path can be found in the plugin's admin partials for chart actions. When processing chart data sources, the plugin directly uses user-supplied input to construct file paths without adequately filtering path traversal sequences or validating that the target file is within expected directories.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a WordPress site with the vulnerable Chartify plugin installed.

The exploitation typically follows this pattern:

1. The attacker identifies a WordPress installation running Chartify plugin version 2.9.5 or earlier
2. A malicious request is crafted with path traversal sequences in the source parameter
3. The attacker can include local files such as /etc/passwd for information disclosure
4. For code execution, the attacker may first upload a file containing PHP code (disguised as an image or other permitted file type) through legitimate upload mechanisms
5. The LFI vulnerability is then used to include and execute the uploaded malicious file

For detailed technical analysis and exploitation techniques, refer to the Abrahack LFI Exploit Post and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-10571

Indicators of Compromise

• HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/) in the source parameter targeting Chartify endpoints
• Access logs showing requests to Chartify plugin endpoints with unusual file path parameters
• Unexpected file access patterns in web server logs, particularly requests attempting to access sensitive system files
• Evidence of PHP file uploads with image extensions or in media directories

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal attempts in query parameters
• Monitor web server access logs for suspicious requests containing .. sequences or encoded variations targeting WordPress plugin endpoints
• Implement file integrity monitoring on WordPress installations to detect unauthorized file modifications or additions
• Use security plugins that can detect vulnerable plugin versions and alert administrators

Monitoring Recommendations

• Enable verbose logging on WordPress installations and regularly review logs for anomalous activity
• Set up alerts for access attempts to sensitive files such as wp-config.php, /etc/passwd, or other system files
• Monitor for unusual PHP execution patterns or new PHP files appearing in upload directories
• Implement network-level monitoring for outbound connections from the web server that may indicate post-exploitation activity

How to Mitigate CVE-2024-10571

Immediate Actions Required

• Update the Chartify – WordPress Chart Plugin to version 2.9.6 or later immediately
• If immediate patching is not possible, deactivate and remove the Chartify plugin until it can be updated
• Review server access logs for signs of exploitation attempts
• Conduct a security audit of the WordPress installation to check for signs of compromise
• Reset all WordPress user credentials if exploitation is suspected

Patch Information

The vulnerability has been addressed in Chartify version 2.9.6. The fix implements proper input validation and sanitization for the source parameter, preventing path traversal attacks. The patched code can be reviewed at the WordPress Plugin Trac repository.

To update the plugin:

1. Log in to the WordPress admin dashboard
2. Navigate to Plugins → Installed Plugins
3. Locate Chartify – WordPress Chart Plugin
4. Click "Update Now" if an update is available
5. Verify the plugin version is 2.9.6 or higher after updating

Workarounds

• Temporarily disable the Chartify plugin if updating is not immediately possible
• Implement WAF rules to block requests containing path traversal patterns in WordPress plugin parameters
• Restrict access to WordPress admin endpoints using IP whitelisting where feasible
• Consider using a security plugin like Wordfence to add an additional layer of protection against LFI attempts

# Example .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\.\/|\.\.%2f) [NC,OR]
    RewriteCond %{QUERY_STRING} (source=.*\.\.) [NC]
    RewriteRule ^(.*)$ - [F,L]
</IfModule>