CVE-2024-3136: Masterstudy LMS RCE Vulnerability

CVE-2024-3136 Overview

The MasterStudy LMS plugin for WordPress contains a critical Local File Inclusion (LFI) vulnerability in all versions up to and including 3.3.3. The vulnerability exists in the template parameter handling, which fails to properly validate and sanitize user-supplied input before including files. This security flaw allows unauthenticated attackers to include and execute arbitrary files on the server, enabling execution of any PHP code present in those files. Attackers can leverage this vulnerability to bypass access controls, obtain sensitive data, or achieve full remote code execution when combined with file upload capabilities.

Critical Impact

Unauthenticated attackers can achieve remote code execution by including arbitrary PHP files through the vulnerable template parameter, potentially leading to complete site takeover.

Affected Products

• MasterStudy LMS WordPress Plugin versions up to and including 3.3.3
• stylemixthemes masterstudy_lms

Discovery Timeline

• April 9, 2024 - CVE-2024-3136 published to NVD
• January 17, 2025 - Last updated in NVD database

Technical Details for CVE-2024-3136

Vulnerability Analysis

This Local File Inclusion vulnerability stems from insufficient input validation in the MasterStudy LMS plugin's template loading mechanism. The vulnerable code accepts a template parameter that is used to dynamically include PHP files without adequate path sanitization or validation. Since no authentication is required to exploit this vulnerability, any remote attacker with network access to the WordPress installation can trigger the file inclusion.

The vulnerability is particularly dangerous because it allows attackers to include both local files from the server's filesystem and potentially uploaded files. When combined with file upload functionality (even for "safe" file types like images), attackers can upload a file containing embedded PHP code and then use the LFI vulnerability to execute that code, effectively achieving remote code execution.

Root Cause

The root cause of CVE-2024-3136 is improper input validation in the helpers.php and templates.php files within the plugin's core LMS classes. The template parameter is passed directly to file inclusion functions without proper sanitization, path traversal prevention, or allowlist validation. This allows attackers to manipulate the parameter value to include arbitrary files from the server filesystem.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests targeting the vulnerable template parameter to traverse directories and include arbitrary files. The exploitation flow typically involves:

1. Identifying a WordPress installation running a vulnerable version of MasterStudy LMS
2. Crafting a request with a manipulated template parameter containing path traversal sequences or absolute paths
3. Including sensitive files to extract data, or including an uploaded file containing PHP code for remote code execution

The vulnerability can be exploited in combination with file upload features. If an attacker can upload a file (such as an image with embedded PHP code), they can subsequently use the LFI vulnerability to include and execute that file, bypassing typical access controls.

Detection Methods for CVE-2024-3136

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (e.g., ../) in the template parameter
• Web server logs showing requests to MasterStudy LMS endpoints with suspicious file paths
• Unexpected PHP file executions or access to sensitive system files like /etc/passwd or wp-config.php
• Creation of unknown files in upload directories or temporary locations

Detection Strategies

• Monitor web application logs for requests containing the template parameter with directory traversal patterns
• Implement Web Application Firewall (WAF) rules to detect and block LFI attack patterns
• Configure intrusion detection systems to alert on path traversal attempts targeting WordPress plugins
• Review access logs for requests to MasterStudy LMS endpoints from unexpected sources or with unusual patterns

Monitoring Recommendations

• Enable detailed logging for all WordPress plugin activity and file access operations
• Set up real-time alerting for any file inclusion attempts outside expected template directories
• Monitor for unusual process spawning from web server processes that may indicate code execution
• Track file system changes in WordPress upload and plugin directories for unexpected modifications

How to Mitigate CVE-2024-3136

Immediate Actions Required

• Update MasterStudy LMS plugin to version 3.3.4 or later immediately
• Review web server logs for signs of exploitation attempts
• Audit uploaded files for any suspicious content or embedded PHP code
• Consider temporarily disabling the MasterStudy LMS plugin if immediate patching is not possible

Patch Information

StyleMixThemes has released a security patch addressing this vulnerability. The fix can be found in WordPress Plugin Changeset 3064337, which modifies the helpers.php and templates.php files in the plugin's core classes. Administrators should update to the latest version of MasterStudy LMS through the WordPress plugin update mechanism or by downloading directly from the WordPress plugin repository.

Additional technical details about this vulnerability are available in the Wordfence Vulnerability Report.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns and LFI attempts
• Restrict file upload capabilities until the plugin is patched
• Implement server-level restrictions using open_basedir PHP directive to limit file access
• Consider disabling the vulnerable plugin functionality until the official patch can be applied

# Example Apache ModSecurity rule to block LFI attempts
SecRule REQUEST_URI "@contains template=" \
    "id:100001,phase:2,deny,status:403,log,msg:'Potential LFI attempt blocked'"

# PHP configuration to restrict file access
# Add to php.ini or .htaccess
# open_basedir = /var/www/html:/tmp