CVE-2024-3229: Salon Booking System Plugin RCE Vulnerability

CVE-2024-3229 Overview

The Salon booking system plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SLN_Action_Ajax_ImportAssistants function along with missing authorization checks in all versions up to, and including, 10.2. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Critical Impact
Unauthenticated attackers can execute arbitrary code on the server, leading to potential data breach or loss.

Affected Products

salonbookingsystem salon_booking_system

Discovery Timeline

2024-06-19 - CVE CVE-2024-3229 published to NVD
2025-04-11 - Last updated in NVD database

Technical Details for CVE-2024-3229

Vulnerability Analysis

The vulnerability involves improper handling of file uploads in the SLN_Action_Ajax_ImportAssistants function, where missing file type validation and authorization checks allow arbitrary file uploads. This flaw enables attackers to upload malicious scripts, which can then be executed on the server.

Root Cause

The root cause is the lack of validation for file type and absence of authorization checks, leading to improper access control in the file upload mechanism.

Attack Vector

The attack is conducted over the network, where an attacker can exploit this vulnerability remotely without authentication.

php

// Example exploitation code (sanitized)
$file = $_FILES['file'];
move_uploaded_file($file['tmp_name'], '/var/www/html/uploads/' . $file['name']);
echo "File uploaded successfully.";

Detection Methods for CVE-2024-3229

Indicators of Compromise

Unusual file uploads in the server directories
Unexpected PHP script executions
Anomalies in web server logs

Detection Strategies

Utilize file integrity monitoring systems to detect unauthorized file uploads. Monitor HTTP requests and server logs for abnormal file access patterns.

Monitoring Recommendations

Regularly review web server logs for irregular upload activity and deploy a Web Application Firewall (WAF) to alert on suspicious file operations.

How to Mitigate CVE-2024-3229

Immediate Actions Required

Disable the use of the vulnerable function in production environments
Employ input validation for file uploads
Strengthen authentication checks for upload functionality

Patch Information

A patch is available from the vendor addressing the vulnerability in function SLN_Action_Ajax_ImportAssistants. Update to the latest version where the checks have been implemented.

Workarounds

As a temporary measure before patching, disable upload feature for unauthenticated users and introduce a sanitation mechanism for file types.

bash

# Configuration example
if [ "$AUTHENTICATED" = false ]; then
  echo "Access denied"
  exit 1
fi

# Add file type validation
if ! [[ "$FILE_TYPE" =~ ^(jpg|png|gif|pdf)$ ]]; then
  echo "Invalid file type"
  exit 1
fi