CVE-2024-2411: MasterStudy LMS RCE Vulnerability

CVE-2024-2411 Overview

The MasterStudy LMS plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 3.3.0. The vulnerability exists in the modal parameter, which fails to properly sanitize user input before including files from the server. This allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of any PHP code contained within those files. Attackers can leverage this vulnerability to bypass access controls, obtain sensitive data, or achieve remote code execution when combined with file upload capabilities.

Critical Impact

Unauthenticated attackers can achieve arbitrary PHP code execution on vulnerable WordPress installations, potentially leading to complete site compromise, data theft, and lateral movement within the hosting environment.

Affected Products

• MasterStudy LMS WordPress Plugin versions up to and including 3.3.0
• WordPress installations running vulnerable versions of MasterStudy LMS by StylemixThemes

Discovery Timeline

• 2024-03-29 - CVE-2024-2411 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-2411

Vulnerability Analysis

This Local File Inclusion vulnerability stems from insufficient input validation in the MasterStudy LMS plugin's modal handling functionality. When processing requests that include the modal parameter, the plugin fails to adequately sanitize the user-supplied input before using it in a file inclusion operation. This allows attackers to manipulate the parameter value to traverse directories and include arbitrary files from the server filesystem.

The vulnerability is particularly severe because it can be exploited by unauthenticated users, meaning no WordPress account or special privileges are required to launch an attack. When combined with the ability to upload files through legitimate plugin functionality (such as course materials or profile images), attackers can upload a malicious PHP file disguised as an image and then use this LFI vulnerability to execute it.

Root Cause

The root cause of CVE-2024-2411 is the absence of proper input validation and path traversal prevention mechanisms in the code handling the modal parameter. The plugin directly incorporates user-supplied input into file path operations without implementing allowlist validation, directory traversal filtering, or other security controls that would prevent malicious file inclusion.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which describes scenarios where PHP's file inclusion functions are used with untrusted input, allowing attackers to manipulate which files get included and executed.

Attack Vector

The attack can be performed remotely over the network without authentication. An attacker would craft a malicious HTTP request targeting the vulnerable endpoint, manipulating the modal parameter to include a path to a file of their choosing. The attack flow typically involves:

1. Identifying a WordPress installation running a vulnerable version of MasterStudy LMS
2. Uploading a malicious PHP file through any available upload functionality, or locating an existing file on the system that can be leveraged
3. Crafting a request with directory traversal sequences in the modal parameter to include the target file
4. The server processes the request and executes the PHP code within the included file

For technical implementation details and the specific code changes made to address this vulnerability, refer to the WordPress Plugin Changeset 3055398.

Detection Methods for CVE-2024-2411

Indicators of Compromise

• Unusual HTTP requests to WordPress endpoints containing the modal parameter with directory traversal sequences (e.g., ../, ..%2f, ....//)
• Web server access logs showing requests with path traversal patterns targeting MasterStudy LMS plugin files
• Unexpected PHP files in upload directories or temporary folders
• New or modified files in the WordPress installation outside of normal update patterns
• Anomalous outbound network connections from the web server

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal patterns in the modal parameter
• Deploy file integrity monitoring on the WordPress installation to detect unauthorized file modifications or additions
• Configure intrusion detection systems to alert on LFI attack patterns targeting PHP applications
• Review web server access logs for requests containing encoded directory traversal sequences

Monitoring Recommendations

• Enable verbose logging on the WordPress installation and web server to capture detailed request information
• Monitor for unexpected process spawning or network connections originating from the web server process
• Set up alerts for authentication failures or privilege escalation attempts following potential LFI exploitation
• Track file upload activity and correlate with subsequent requests that may attempt to include uploaded files

How to Mitigate CVE-2024-2411

Immediate Actions Required

• Update MasterStudy LMS plugin to version 3.3.1 or later immediately
• Audit WordPress installations to identify all instances running vulnerable versions of the plugin
• Review web server logs for any signs of exploitation attempts against the modal parameter
• Conduct a security assessment to determine if any compromise has occurred

Patch Information

StylemixThemes has released version 3.3.1 of the MasterStudy LMS plugin which addresses this vulnerability. The patch implements proper input validation and sanitization for the modal parameter to prevent directory traversal and arbitrary file inclusion.

For detailed patch information, refer to the Stylemix Themes Changelog 3.3.1. Additional technical details about the code changes can be found in the WordPress Plugin Changeset 3055398.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the MasterStudy LMS plugin until the update can be applied
• Implement WAF rules to block requests containing directory traversal patterns in the modal parameter
• Restrict file upload capabilities to authenticated and trusted users only
• Apply PHP configuration hardening such as disabling allow_url_include and restricting open_basedir

# PHP configuration hardening (php.ini)
# Disable remote file inclusion
allow_url_include = Off

# Restrict file operations to specific directories
open_basedir = /var/www/html/:/tmp/

# Disable dangerous functions if not needed
disable_functions = exec,passthru,shell_exec,system,proc_open,popen