CVE-2024-25913: Skymoonlabs MoveTo File Upload Vulnerability

CVE-2024-25913 Overview

CVE-2024-25913 is an Unrestricted Upload of File with Dangerous Type vulnerability in the Skymoonlabs MoveTo WordPress plugin. This vulnerability allows unauthenticated attackers to upload arbitrary files, including malicious executable scripts, to the web server without proper validation or sanitization. Once uploaded, these files can be executed on the server, potentially leading to complete server compromise.

Critical Impact

Unauthenticated attackers can upload and execute malicious files on affected WordPress installations, enabling remote code execution and full server compromise without any user interaction required.

Affected Products

• Skymoonlabs MoveTo plugin versions up through 6.2
• WordPress installations using the vulnerable MoveTo plugin
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2024-02-26 - CVE-2024-25913 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2024-25913

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type), a critical class of web application security flaws. The MoveTo plugin fails to properly validate file types during the upload process, allowing attackers to bypass intended restrictions and upload files with dangerous extensions such as .php, .phtml, or other executable file types.

The attack can be performed remotely over the network without requiring any authentication or user interaction. Successful exploitation grants attackers the ability to compromise confidentiality, integrity, and availability of the affected system. An attacker could upload a web shell or other malicious script, then execute it to gain persistent access, exfiltrate data, modify website content, or pivot to attack other systems on the network.

Root Cause

The root cause of this vulnerability is the absence of proper file type validation and sanitization in the MoveTo plugin's upload functionality. The plugin does not adequately restrict which file types can be uploaded, nor does it properly verify the content of uploaded files against their declared MIME types. This allows attackers to upload executable PHP files disguised as legitimate content or directly upload malicious scripts.

Attack Vector

The attack vector is network-based, meaning the vulnerability can be exploited remotely by any unauthenticated attacker with network access to the WordPress installation. The attack flow typically follows this pattern:

1. The attacker identifies a WordPress site running the vulnerable MoveTo plugin (versions through 6.2)
2. The attacker crafts a malicious file (such as a PHP web shell)
3. The attacker submits the malicious file through the plugin's upload endpoint
4. Due to missing validation, the file is accepted and stored on the server
5. The attacker accesses the uploaded file via its URL, executing the malicious code
6. The attacker gains remote code execution capabilities on the server

The vulnerability is particularly dangerous because it requires no authentication, meaning any anonymous attacker can exploit it without needing valid credentials.

Detection Methods for CVE-2024-25913

Indicators of Compromise

• Unexpected PHP or executable files appearing in WordPress upload directories
• Web server logs showing requests to unusual file paths within the wp-content/uploads/ directory
• Presence of files with suspicious names or double extensions (e.g., image.php.jpg)
• Outbound network connections from the web server to unknown external IPs

Detection Strategies

• Monitor file system changes in WordPress upload directories for newly created executable files
• Implement web application firewall (WAF) rules to detect and block file upload attempts containing PHP code
• Review web server access logs for POST requests to MoveTo plugin endpoints followed by GET requests to uploaded files
• Use file integrity monitoring to detect unauthorized additions to the WordPress installation

Monitoring Recommendations

• Enable detailed logging for all file upload activities in WordPress
• Configure alerts for any PHP file creation within upload directories
• Implement real-time monitoring of outbound connections from web servers
• Regularly audit installed WordPress plugins and their versions against known vulnerability databases

How to Mitigate CVE-2024-25913

Immediate Actions Required

• Update the Skymoonlabs MoveTo plugin to the latest patched version immediately
• If an update is not available, disable and remove the MoveTo plugin until a fix is released
• Audit upload directories for any suspicious or unexpected files and remove any malicious content
• Review server logs for signs of exploitation and investigate any suspicious activity

Patch Information

Organizations should check for updates from Skymoonlabs for the MoveTo WordPress plugin. Consult the Patchstack Vulnerability Database Entry for the latest remediation guidance and patch availability. Until a patch is applied, the plugin should be considered a significant security risk.

Workarounds

• Disable the MoveTo plugin entirely until a security patch is available
• Implement server-level restrictions to prevent PHP execution in upload directories using .htaccess rules
• Configure a Web Application Firewall (WAF) to block suspicious file upload attempts
• Restrict network access to WordPress admin and upload endpoints using IP whitelisting where feasible

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in wp-content/uploads/
<FilesMatch "\.(?:php|phtml|php[0-9])$">
    Require all denied
</FilesMatch>

# For older Apache versions:
# <FilesMatch "\.(?:php|phtml|php[0-9])$">
#     Order Allow,Deny
#     Deny from all
# </FilesMatch>