CVE-2024-22144: Anti-Malware Security Plugin RCE Flaw

CVE-2024-22144 Overview

CVE-2024-22144 is a critical code injection vulnerability affecting the Anti-Malware Security and Brute-Force Firewall WordPress plugin (gotmls) developed by Eli Scheetz. This vulnerability allows unauthenticated attackers to exploit predictable nonce values through brute-force techniques, ultimately leading to remote code execution on vulnerable WordPress installations.

The vulnerability stems from improper control of code generation (CWE-94), enabling attackers to inject and execute arbitrary code on the target system without requiring any authentication or user interaction.

Critical Impact

Unauthenticated remote code execution through predictable nonce brute-forcing allows complete server compromise, data theft, and malware deployment on WordPress sites running vulnerable versions of the Anti-Malware Security and Brute-Force Firewall plugin.

Affected Products

• Anti-Malware Security and Brute-Force Firewall (gotmls) through version 4.21.96
• WordPress installations running the vulnerable plugin versions
• All server environments hosting affected WordPress sites

Discovery Timeline

• April 25, 2024 - CVE-2024-22144 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-22144

Vulnerability Analysis

This code injection vulnerability in the gotmls WordPress plugin represents a severe security flaw that allows unauthenticated attackers to achieve remote code execution. The vulnerability exists due to the plugin's use of predictable nonce values that can be brute-forced by attackers.

WordPress nonces are intended to provide protection against cross-site request forgery (CSRF) attacks by generating unpredictable tokens. However, the gotmls plugin implements a flawed nonce generation mechanism that produces predictable values. An attacker can systematically brute-force these nonce values to bypass security controls and inject malicious code into the application.

The attack can be executed remotely over the network without requiring authentication credentials or any user interaction, making it particularly dangerous for exposed WordPress installations.

Root Cause

The root cause of this vulnerability lies in the improper implementation of nonce generation within the Anti-Malware Security and Brute-Force Firewall plugin. The plugin uses predictable patterns or insufficient entropy when generating security tokens, allowing attackers to calculate or brute-force valid nonce values. Once a valid nonce is obtained, the attacker can bypass CSRF protections and leverage code injection vectors within the plugin's functionality to execute arbitrary code on the server.

Attack Vector

The attack vector for CVE-2024-22144 is network-based, requiring no authentication or user interaction. An attacker targeting a vulnerable WordPress site would:

1. Identify the presence of the gotmls plugin on the target WordPress installation
2. Analyze the predictable nonce generation pattern used by the plugin
3. Brute-force the nonce values to obtain a valid security token
4. Craft a malicious request containing injected code along with the brute-forced nonce
5. Submit the request to the vulnerable endpoint, achieving code execution on the server

The attack complexity is considered high due to the brute-forcing requirement, but successful exploitation results in complete system compromise with impacts to confidentiality, integrity, and availability extending beyond the vulnerable component (changed scope).

For detailed technical analysis of this vulnerability, refer to the Patchstack Vulnerability Article and Stealthcopter CVE Analysis.

Detection Methods for CVE-2024-22144

Indicators of Compromise

• Unusual HTTP requests targeting gotmls plugin endpoints with repeated nonce parameter variations
• Unexpected PHP files or modified plugin files in the wp-content/plugins/gotmls/ directory
• Server logs showing brute-force patterns against WordPress admin-ajax.php with gotmls-related actions
• Suspicious outbound network connections from the web server process
• Unexpected scheduled tasks or cron jobs created on the WordPress installation

Detection Strategies

• Monitor web application firewall (WAF) logs for high-volume requests to WordPress admin endpoints with varying nonce parameters
• Implement file integrity monitoring on the gotmls plugin directory and WordPress core files
• Deploy intrusion detection rules to identify code injection patterns in HTTP request bodies
• Review WordPress user accounts and administrative access for unauthorized changes
• Analyze server access logs for anomalous request patterns targeting plugin-specific endpoints

Monitoring Recommendations

• Enable detailed logging for WordPress and PHP to capture injection attempts
• Configure alerts for file modifications within the WordPress plugins directory
• Monitor server resource usage for unexpected spikes indicating exploitation activity
• Implement network traffic analysis to detect command and control communications
• Set up monitoring for new administrator accounts or privilege escalation events

How to Mitigate CVE-2024-22144

Immediate Actions Required

• Update the Anti-Malware Security and Brute-Force Firewall plugin to a version newer than 4.21.96 immediately
• If an update is not available, consider temporarily disabling the gotmls plugin until a patch is released
• Audit WordPress installations for signs of compromise before and after updating
• Review and restore any modified files from known-good backups
• Change all WordPress administrator passwords and API keys as a precautionary measure

Patch Information

Organizations should update to the latest version of the Anti-Malware Security and Brute-Force Firewall plugin that addresses this vulnerability. Check the Patchstack Vulnerability Database Entry for the latest patch information and version details.

Always download plugin updates directly from the official WordPress plugin repository to ensure authenticity and integrity of the update.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to block suspicious requests targeting the gotmls plugin
• Restrict access to WordPress admin endpoints using IP allowlisting where feasible
• Enable WordPress security hardening measures including disabling file editing from the admin panel
• Consider using security plugins that provide additional nonce validation and request filtering
• Temporarily deactivate the gotmls plugin if updates are not immediately available

# Disable the vulnerable plugin via WP-CLI if immediate patching is not possible
wp plugin deactivate gotmls --path=/var/www/html/wordpress

# Verify plugin status
wp plugin list --path=/var/www/html/wordpress | grep gotmls

# After updating, re-enable and verify version
wp plugin activate gotmls --path=/var/www/html/wordpress
wp plugin get gotmls --field=version --path=/var/www/html/wordpress