CVE-2024-11150: Vanquish User Extra Fields RCE Vulnerability

CVE-2024-11150 Overview

The WordPress User Extra Fields plugin for WordPress contains a critical arbitrary file deletion vulnerability due to insufficient file path validation in the delete_tmp_uploaded_file() function. This vulnerability affects all versions up to and including 16.6, allowing unauthenticated attackers to delete arbitrary files on the server. When critical files such as wp-config.php are deleted, this can lead to remote code execution, as WordPress may enter a reinstallation state that attackers can exploit to gain full control of the site.

Critical Impact

Unauthenticated attackers can delete arbitrary files on the server, potentially leading to complete site takeover through remote code execution when critical configuration files are removed.

Affected Products

• Vanquish User Extra Fields plugin for WordPress (all versions up to and including 16.6)

Discovery Timeline

• November 13, 2024 - CVE-2024-11150 published to NVD
• November 19, 2024 - Last updated in NVD database

Technical Details for CVE-2024-11150

Vulnerability Analysis

This vulnerability stems from a path traversal weakness (CWE-22) in the WordPress User Extra Fields plugin's file handling mechanism. The delete_tmp_uploaded_file() function fails to properly validate and sanitize file paths before processing deletion requests, enabling attackers to traverse directory structures and delete files outside the intended upload directories.

The vulnerability is particularly dangerous because it requires no authentication to exploit. An attacker can craft a malicious request targeting the vulnerable function, using path traversal sequences to specify arbitrary files on the server for deletion. When leveraged against WordPress core files like wp-config.php, this vulnerability becomes a stepping stone to remote code execution.

Root Cause

The root cause of CVE-2024-11150 is insufficient file path validation within the delete_tmp_uploaded_file() function. The function accepts user-controlled input specifying which file to delete but does not adequately sanitize this input to prevent directory traversal attacks. Without proper validation to ensure the target file resides within expected directories, attackers can use sequences like ../ to escape the intended directory context and target any file accessible by the web server process.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can send specially crafted HTTP requests to the vulnerable endpoint, including path traversal sequences in the file parameter. The attack flow typically proceeds as follows:

1. The attacker identifies a WordPress site using the vulnerable User Extra Fields plugin version
2. A malicious request is crafted targeting the delete_tmp_uploaded_file() function
3. Path traversal sequences are used to specify critical files like wp-config.php
4. Upon successful file deletion, the attacker can force WordPress into reinstallation mode
5. The attacker completes the installation process with their own credentials, achieving full site compromise

For detailed technical analysis of this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-11150

Indicators of Compromise

• Unexpected HTTP requests to the User Extra Fields plugin endpoints containing path traversal sequences (../ or encoded variants)
• Missing critical WordPress files such as wp-config.php, .htaccess, or core plugin files
• WordPress site unexpectedly entering installation/setup mode
• Web server logs showing DELETE or POST requests with file path parameters containing directory traversal patterns

Detection Strategies

• Monitor web server access logs for requests to User Extra Fields plugin endpoints containing ../, ..%2f, or similar path traversal patterns
• Implement file integrity monitoring to detect unauthorized deletion of WordPress core and configuration files
• Deploy Web Application Firewall (WAF) rules to detect and block path traversal attempts in request parameters
• Configure alerting for any requests to the delete_tmp_uploaded_file functionality from unauthenticated sessions

Monitoring Recommendations

• Enable comprehensive logging for all file system operations performed by WordPress and its plugins
• Set up real-time alerts for deletion of critical files including wp-config.php, index.php, and .htaccess
• Monitor for WordPress installations entering setup/installation mode when they should be fully configured
• Track authentication patterns and watch for new administrator accounts created following file deletion events

How to Mitigate CVE-2024-11150

Immediate Actions Required

• Update the WordPress User Extra Fields plugin to a version newer than 16.6 immediately
• If an update is not available, temporarily disable and remove the User Extra Fields plugin until a patch is released
• Review web server logs for any evidence of exploitation attempts
• Verify the integrity of critical WordPress files, particularly wp-config.php
• Implement WAF rules to block path traversal attempts targeting WordPress plugins

Patch Information

Organizations using the WordPress User Extra Fields plugin should check for updates through the WordPress admin dashboard or the CodeCanyon Plugin Overview page. Ensure you are running a version newer than 16.6, which addresses this vulnerability. If no patched version is available, consider alternative plugins or implement additional security controls.

Workarounds

• Disable the WordPress User Extra Fields plugin until a security update is available
• Implement WAF rules to filter requests containing path traversal sequences targeting the plugin's endpoints
• Restrict access to the WordPress admin and plugin directories using server-level access controls
• Enable file system permissions that prevent the web server user from deleting critical WordPress configuration files
• Consider implementing a WordPress security plugin that provides real-time file integrity monitoring

# Configuration example - Restrict file permissions to protect wp-config.php
chmod 400 wp-config.php
chown root:root wp-config.php

# Apache .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f) [NC,OR]
RewriteCond %{REQUEST_URI} (\.\./|\.\.%2f) [NC]
RewriteRule .* - [F,L]
</IfModule>