CVE-2024-24797: ERE Recently Viewed Deserialization Flaw

CVE-2024-24797 Overview

CVE-2024-24797 is a critical Insecure Deserialization vulnerability affecting the ERE Recently Viewed plugin for WordPress, developed by G5Theme as an add-on for the Essential Real Estate plugin. This vulnerability allows unauthenticated attackers to inject malicious PHP objects through the deserialization of untrusted data, potentially leading to remote code execution, data exfiltration, or complete site compromise.

Critical Impact

Unauthenticated attackers can exploit this PHP Object Injection vulnerability to execute arbitrary code on vulnerable WordPress installations without any user interaction, potentially leading to full server compromise.

Affected Products

• G5plus ERE Recently Viewed plugin versions through 1.3
• WordPress sites using the Essential Real Estate Add-On with the ERE Recently Viewed module
• Any WordPress installation with the vulnerable ere-recently-viewed plugin activated

Discovery Timeline

• 2024-02-12 - CVE CVE-2024-24797 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24797

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), a weakness that occurs when an application deserializes data from untrusted sources without proper validation. In the context of this WordPress plugin, the ERE Recently Viewed functionality processes serialized PHP data that can be manipulated by attackers.

The vulnerability is particularly dangerous because it can be exploited by unauthenticated users over the network without any user interaction required. When successful, attackers can achieve full compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Root Cause

The root cause of CVE-2024-24797 lies in the improper handling of serialized data within the ERE Recently Viewed plugin. The plugin fails to adequately validate or sanitize serialized PHP objects before passing them to the unserialize() function. This allows attackers to craft malicious serialized payloads that, when deserialized, can trigger dangerous operations through PHP's magic methods such as __wakeup(), __destruct(), or __toString().

When a vulnerable WordPress installation contains other plugins or themes with exploitable gadget chains, attackers can leverage this PHP Object Injection vulnerability to achieve remote code execution.

Attack Vector

The attack vector for CVE-2024-24797 is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a WordPress site running the vulnerable ERE Recently Viewed plugin (versions through 1.3)
2. Crafting a malicious serialized PHP object containing a POP (Property Oriented Programming) chain
3. Submitting the malicious payload to the vulnerable endpoint that processes recently viewed property data
4. The vulnerable plugin deserializes the attacker-controlled data, instantiating malicious objects
5. PHP magic methods execute during deserialization, triggering the attacker's payload

The exploitation mechanism relies on the presence of suitable gadget chains within the WordPress installation. Common gadget chains can be found in popular WordPress plugins, themes, or the WordPress core itself. Tools like PHPGGC can be used to generate payloads for known gadget chains.

For detailed technical analysis and proof-of-concept information, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-24797

Indicators of Compromise

• Unusual serialized data patterns in HTTP POST requests containing PHP object notation (e.g., O: or a: prefixes)
• Web server logs showing requests with serialized payloads to WordPress endpoints associated with the ERE Recently Viewed plugin
• Unexpected file creation or modification in the WordPress installation directory
• Evidence of webshells or backdoor files created after exploitation

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in incoming requests
• Monitor WordPress debug logs and PHP error logs for deserialization-related errors or warnings
• Implement file integrity monitoring to detect unauthorized changes to WordPress core files, themes, and plugins
• Use endpoint detection solutions like SentinelOne to identify post-exploitation activities

Monitoring Recommendations

• Enable verbose logging on web servers to capture full request bodies for forensic analysis
• Configure alerts for unusual process spawning from PHP or web server processes
• Monitor outbound network connections from the WordPress server for data exfiltration attempts
• Regularly scan installed plugins against vulnerability databases to identify outdated or vulnerable components

How to Mitigate CVE-2024-24797

Immediate Actions Required

• Update the ERE Recently Viewed plugin to the latest patched version immediately
• If an update is not available, disable and remove the vulnerable plugin until a patch is released
• Conduct a security audit of the WordPress installation to identify any signs of compromise
• Review and harden WordPress security configurations, including file permissions and user privileges

Patch Information

Organizations using the ERE Recently Viewed plugin should check with G5Theme for the latest security updates. The vulnerability affects all versions from n/a through 1.3. Administrators should update to any version released after the security advisory that addresses this PHP Object Injection vulnerability.

For additional details on the vulnerability and remediation guidance, refer to the Patchstack Vulnerability Report.

Workarounds

• Deploy a Web Application Firewall with rules to block serialized PHP object injection attempts
• Implement server-level input validation to reject requests containing suspicious serialized data patterns
• Consider using WordPress security plugins that provide virtual patching capabilities for known vulnerabilities
• Restrict access to WordPress admin areas and limit the attack surface through network segmentation

# Example WAF rule to block PHP serialized objects in requests
# Add to .htaccess or web server configuration
RewriteEngine On
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_BODY} (O:|a:|s:)[0-9]+:
RewriteRule .* - [F,L]