CVE-2024-22144: Anti-Malware Security Plugin RCE Flaw

CVE-2024-22144 Overview

CVE-2024-22144 is a critical code injection vulnerability affecting the Anti-Malware Security and Brute-Force Firewall WordPress plugin (gotmls) developed by Eli Scheetz. This vulnerability allows unauthenticated attackers to exploit predictable nonce values through brute-force techniques, ultimately leading to remote code execution on vulnerable WordPress installations.

The vulnerability stems from improper control of code generation (CWE-94), enabling attackers to inject and execute arbitrary code on the target system without requiring any authentication or user interaction.

Critical Impact
Unauthenticated remote code execution through predictable nonce brute-forcing allows complete server compromise, data theft, and malware deployment on WordPress sites running vulnerable versions of the Anti-Malware Security and Brute-Force Firewall plugin.

Affected Products

Anti-Malware Security and Brute-Force Firewall (gotmls) through version 4.21.96
WordPress installations running the vulnerable plugin versions
All server environments hosting affected WordPress sites

Discovery Timeline

April 25, 2024 - CVE-2024-22144 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-22144

Vulnerability Analysis

This code injection vulnerability in the gotmls WordPress plugin represents a severe security flaw that allows unauthenticated attackers to achieve remote code execution. The vulnerability exists due to the plugin's use of predictable nonce values that can be brute-forced by attackers.

WordPress nonces are intended to provide protection against cross-site request forgery (CSRF) attacks by generating unpredictable tokens. However, the gotmls plugin implements a flawed nonce generation mechanism that produces predictable values. An attacker can systematically brute-force these nonce values to bypass security controls and inject malicious code into the application.

The attack can be executed remotely over the network without requiring authentication credentials or any user interaction, making it particularly dangerous for exposed WordPress installations.

Root Cause

The root cause of this vulnerability lies in the improper implementation of nonce generation within the Anti-Malware Security and Brute-Force Firewall plugin. The plugin uses predictable patterns or insufficient entropy when generating security tokens, allowing attackers to calculate or brute-force valid nonce values. Once a valid nonce is obtained, the attacker can bypass CSRF protections and leverage code injection vectors within the plugin's functionality to execute arbitrary code on the server.

Attack Vector

The attack vector for CVE-2024-22144 is network-based, requiring no authentication or user interaction. An attacker targeting a vulnerable WordPress site would:

Identify the presence of the gotmls plugin on the target WordPress installation
Analyze the predictable nonce generation pattern used by the plugin
Brute-force the nonce values to obtain a valid security token
Craft a malicious request containing injected code along with the brute-forced nonce
Submit the request to the vulnerable endpoint, achieving code execution on the server

The attack complexity is considered high due to the brute-forcing requirement, but successful exploitation results in complete system compromise with impacts to confidentiality, integrity, and availability extending beyond the vulnerable component (changed scope).

For detailed technical analysis of this vulnerability, refer to the Patchstack Vulnerability Article and Stealthcopter CVE Analysis.

Detection Methods for CVE-2024-22144

Indicators of Compromise

Unusual HTTP requests targeting gotmls plugin endpoints with repeated nonce parameter variations
Unexpected PHP files or modified plugin files in the wp-content/plugins/gotmls/ directory
Server logs showing brute-force patterns against WordPress admin-ajax.php with gotmls-related actions
Suspicious outbound network connections from the web server process
Unexpected scheduled tasks or cron jobs created on the WordPress installation

Detection Strategies

Monitor web application firewall (WAF) logs for high-volume requests to WordPress admin endpoints with varying nonce parameters
Implement file integrity monitoring on the gotmls plugin directory and WordPress core files
Deploy intrusion detection rules to identify code injection patterns in HTTP request bodies
Review WordPress user accounts and administrative access for unauthorized changes
Analyze server access logs for anomalous request patterns targeting plugin-specific endpoints

Monitoring Recommendations

Enable detailed logging for WordPress and PHP to capture injection attempts
Configure alerts for file modifications within the WordPress plugins directory
Monitor server resource usage for unexpected spikes indicating exploitation activity
Implement network traffic analysis to detect command and control communications
Set up monitoring for new administrator accounts or privilege escalation events

How to Mitigate CVE-2024-22144

Immediate Actions Required

Update the Anti-Malware Security and Brute-Force Firewall plugin to a version newer than 4.21.96 immediately
If an update is not available, consider temporarily disabling the gotmls plugin until a patch is released
Audit WordPress installations for signs of compromise before and after updating
Review and restore any modified files from known-good backups
Change all WordPress administrator passwords and API keys as a precautionary measure

Patch Information

Organizations should update to the latest version of the Anti-Malware Security and Brute-Force Firewall plugin that addresses this vulnerability. Check the Patchstack Vulnerability Database Entry for the latest patch information and version details.

Always download plugin updates directly from the official WordPress plugin repository to ensure authenticity and integrity of the update.

Workarounds

Implement a Web Application Firewall (WAF) with rules to block suspicious requests targeting the gotmls plugin
Restrict access to WordPress admin endpoints using IP allowlisting where feasible
Enable WordPress security hardening measures including disabling file editing from the admin panel
Consider using security plugins that provide additional nonce validation and request filtering
Temporarily deactivate the gotmls plugin if updates are not immediately available

bash

# Disable the vulnerable plugin via WP-CLI if immediate patching is not possible
wp plugin deactivate gotmls --path=/var/www/html/wordpress

# Verify plugin status
wp plugin list --path=/var/www/html/wordpress | grep gotmls

# After updating, re-enable and verify version
wp plugin activate gotmls --path=/var/www/html/wordpress
wp plugin get gotmls --field=version --path=/var/www/html/wordpress