CVE-2024-13365: CleanTalk Security & Malware Scan RCE Flaw

CVE-2024-13365 Overview

The Security & Malware scan by CleanTalk plugin for WordPress contains a critical arbitrary file upload vulnerability that enables unauthenticated remote code execution. The flaw exists in the checkUploadedArchive() function, which fails to properly validate and sanitize uploaded .zip archives during malware scanning operations. This allows attackers to upload malicious files to the affected WordPress server without any authentication.

Critical Impact

Unauthenticated attackers can upload arbitrary files to WordPress servers, potentially leading to complete site compromise through remote code execution.

Affected Products

• CleanTalk Security & Malware Scan plugin for WordPress versions up to and including 2.149

Discovery Timeline

• 2025-02-12 - CVE-2024-13365 published to NVD
• 2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13365

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), which represents a fundamental failure in file upload security controls. The vulnerability allows unauthenticated attackers to bypass all security checks normally required for file uploads in WordPress.

The irony of this vulnerability is significant—a security plugin designed to protect WordPress sites from malware instead introduces a severe attack vector. The checkUploadedArchive() function processes uploaded .zip archives for malware scanning purposes but extracts the archive contents without sufficient validation, allowing attackers to place arbitrary files on the server filesystem.

This vulnerability requires no authentication and can be exploited remotely over the network with no user interaction required. A successful exploit grants attackers the ability to read, modify, or delete any data accessible to the web server, execute arbitrary code on the server, and potentially pivot to other systems on the network.

Root Cause

The root cause lies in the checkUploadedArchive() function's failure to implement proper security controls when handling uploaded .zip archives. The function extracts archive contents during malware scanning operations without adequately validating the file types within the archive or restricting where files can be extracted. This allows attackers to include executable PHP files or other dangerous file types within a .zip archive, which are then extracted to web-accessible locations on the server.

Attack Vector

The attack leverages the plugin's malware scanning functionality as an entry point. An attacker crafts a malicious .zip archive containing a PHP webshell or other executable payload. By submitting this archive to the vulnerable endpoint, the attacker triggers the checkUploadedArchive() function, which extracts the malicious files to the WordPress server. Once extracted, the attacker can access the uploaded webshell directly via HTTP to execute arbitrary commands on the server.

The attack can be executed entirely without authentication, making it particularly dangerous for any WordPress site running vulnerable versions of this plugin. The network-based attack vector means any internet-facing WordPress installation is at risk.

Detection Methods for CVE-2024-13365

Indicators of Compromise

• Unexpected .php files appearing in WordPress directories, particularly in wp-content/uploads/ or plugin directories
• Suspicious .zip file uploads in server access logs targeting CleanTalk plugin endpoints
• Web server logs showing requests to unfamiliar PHP files that don't match known WordPress or plugin files
• Unusual outbound network connections from the web server process

Detection Strategies

• Monitor web server access logs for POST requests to CleanTalk plugin endpoints containing .zip file uploads
• Implement file integrity monitoring (FIM) to detect unauthorized file creation in WordPress directories
• Deploy web application firewall (WAF) rules to inspect archive uploads for embedded PHP or executable content
• Review server-side logs for any file extraction operations performed by the WordPress process

Monitoring Recommendations

• Enable comprehensive logging for the WordPress wp-content/ directory and all plugin directories
• Configure alerts for any new PHP file creation outside of authorized deployment processes
• Monitor for webshell signatures and behaviors including command execution patterns
• Implement network segmentation monitoring to detect lateral movement attempts from compromised web servers

How to Mitigate CVE-2024-13365

Immediate Actions Required

• Update the CleanTalk Security & Malware Scan plugin to a version newer than 2.149 immediately
• Review WordPress file directories for any unauthorized files that may indicate prior compromise
• If unable to update immediately, disable or remove the CleanTalk Security & Malware Scan plugin until patching is complete
• Conduct a thorough security audit of the WordPress installation to identify any indicators of compromise

Patch Information

CleanTalk has released a security update addressing this vulnerability. The fix is available in the WordPress Security Changeset. Site administrators should update to the latest version of the plugin through the WordPress admin dashboard or by manually downloading and installing the patched version from the WordPress plugin repository.

For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Temporarily disable or uninstall the CleanTalk Security & Malware Scan plugin if immediate patching is not possible
• Implement web application firewall rules to block .zip file uploads to CleanTalk plugin endpoints
• Restrict access to WordPress admin and plugin directories at the web server level using IP allowlisting
• Enable read-only permissions on WordPress plugin directories as a temporary measure to prevent file writes

# Temporarily disable plugin via WordPress CLI
wp plugin deactivate security-malware-firewall

# After updating, re-enable the plugin
wp plugin activate security-malware-firewall

# Verify plugin version after update
wp plugin list --name=security-malware-firewall --fields=name,version,status