CVE-2024-27954: WP Automatic Path Traversal Vulnerability

CVE-2024-27954 Overview

CVE-2024-27954 is a critical vulnerability affecting the WP Automatic plugin for WordPress. This vulnerability combines Path Traversal (CWE-22) with Server-Side Request Forgery (SSRF) capabilities, allowing unauthenticated attackers to download arbitrary files from vulnerable WordPress installations and make unauthorized server-side requests.

The WP Automatic plugin is designed to automatically post content from various sources to WordPress sites. Due to improper limitation of pathname handling, attackers can exploit this flaw without any authentication, potentially exposing sensitive configuration files, database credentials, and enabling further attacks through SSRF.

Critical Impact

Unauthenticated attackers can download arbitrary files from the server and perform SSRF attacks, potentially leading to full site compromise, credential theft, and lateral movement within internal networks.

Affected Products

• WP Automatic plugin versions from n/a through 3.92.0
• WordPress installations using vulnerable WP Automatic versions
• Websites with WP Automatic plugin installed and activated

Discovery Timeline

• 2024-05-17 - CVE-2024-27954 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-27954

Vulnerability Analysis

This vulnerability stems from an Improper Limitation of a Pathname to a Restricted Directory weakness (CWE-22) in the WP Automatic plugin. The flaw enables two distinct attack vectors: arbitrary file download through path traversal and Server-Side Request Forgery.

The path traversal component allows attackers to escape the intended directory structure and access files anywhere on the server filesystem that the web server user has read permissions for. This commonly includes sensitive files such as wp-config.php, which contains database credentials and authentication keys.

The SSRF component enables attackers to make the vulnerable server initiate requests to arbitrary internal or external destinations. This can be leveraged to scan internal networks, access cloud metadata services, or interact with internal services that are not directly accessible from the internet.

Root Cause

The root cause lies in insufficient input validation and sanitization of user-supplied path parameters within the WP Automatic plugin. The plugin fails to properly restrict file path inputs to legitimate directories, allowing directory traversal sequences (such as ../) to navigate outside the intended scope. Additionally, the plugin does not adequately validate or restrict URLs used in server-side requests, enabling SSRF attacks.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker can craft malicious requests to the vulnerable endpoint, including path traversal sequences to access arbitrary files or URLs pointing to internal resources for SSRF exploitation.

For path traversal attacks, the attacker manipulates file path parameters to include directory traversal sequences, escaping the plugin's intended directory and accessing sensitive files like configuration files or system files.

For SSRF attacks, the attacker supplies a URL pointing to internal services or cloud metadata endpoints (such as http://169.254.169.254/ on AWS), causing the server to make requests on the attacker's behalf. For detailed technical information, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-27954

Indicators of Compromise

• Unusual access patterns to WordPress plugin files, particularly requests containing path traversal sequences (../)
• Web server logs showing requests with file paths attempting to access /etc/passwd, wp-config.php, or other sensitive files
• Outbound connections from the web server to unexpected internal IP ranges or cloud metadata services
• Access to WP Automatic plugin endpoints with suspicious URL parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Monitor server access logs for requests containing ../ sequences or attempts to access sensitive file paths
• Enable network monitoring to detect unusual outbound connections from the WordPress server
• Deploy intrusion detection systems (IDS) with signatures for WordPress plugin exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the WordPress installation and web server to capture all requests to plugin endpoints
• Set up alerts for any access attempts to critical configuration files such as wp-config.php
• Monitor outbound network traffic from web servers for connections to internal network ranges or cloud metadata endpoints
• Regularly audit installed WordPress plugins and their versions against known vulnerability databases

How to Mitigate CVE-2024-27954

Immediate Actions Required

• Update the WP Automatic plugin to a version newer than 3.92.0 immediately
• If an update is not available, temporarily deactivate the WP Automatic plugin until a patched version is released
• Review server logs for any signs of exploitation or unauthorized file access
• Rotate WordPress security keys and database credentials if compromise is suspected
• Implement a Web Application Firewall with rules blocking path traversal and SSRF patterns

Patch Information

Users should update the WP Automatic plugin to the latest available version that addresses this vulnerability. Check the Patchstack Vulnerability Report for the latest remediation guidance and patched version information.

Workarounds

• Temporarily disable the WP Automatic plugin if immediate patching is not possible
• Implement WAF rules to block requests containing path traversal patterns targeting the plugin
• Restrict outbound network access from the web server to prevent SSRF exploitation
• Use file system permissions to limit web server access to sensitive configuration files

# Block path traversal patterns in Apache .htaccess
RewriteEngine On
RewriteCond %{REQUEST_URI} \.\./ [NC,OR]
RewriteCond %{REQUEST_URI} \.\. [NC]
RewriteRule .* - [F,L]

# Restrict access to wp-config.php
<Files wp-config.php>
    Order deny,allow
    Deny from all
</Files>