CVE-2024-3962: WooCommerce Product Addons RCE Vulnerability

CVE-2024-3962 Overview

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This vulnerability allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution.

Critical Impact

Unauthorized file uploads can lead to remote code execution on affected servers.

Affected Products

• Themeisle Product Addons & Fields for WooCommerce

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to Themeisle
• Not Available - CVE CVE-2024-3962 assigned
• Not Available - Themeisle releases security patch
• 2024-04-26 - CVE CVE-2024-3962 published to NVD
• 2025-02-07 - Last updated in NVD database

Technical Details for CVE-2024-3962

Vulnerability Analysis

This vulnerability arises from a lack of proper file type validation in the ppom_upload_file function, allowing potential adversaries to upload malicious files. Successful exploitation may result in remote code execution, depending on the server's configuration and the permissions of the uploaded file.

Root Cause

The root cause of CVE-2024-3962 is improper input validation of file types during the upload process within the ppom_upload_file function.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication, making open WooCommerce sites particularly vulnerable.

// Example exploitation code (sanitized)
if (isset($_FILES['uploaded_file'])) {
    $path = '/var/www/uploads/' . basename($_FILES['uploaded_file']['name']);
    if (move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) {
        echo 'File upload successful';
    }
}

Detection Methods for CVE-2024-3962

Indicators of Compromise

• Unusual file types appearing in the uploads directory
• Unexpected PHP or executable files found on the server
• Unrecognized cron jobs or scheduled tasks

Detection Strategies

Implement file integrity monitoring to detect unauthorized changes or additions to the server's file system. Use security tools to scan for malicious uploads, focusing on directories associated with the plugin.

Monitoring Recommendations

Monitor HTTP POST requests to the server, especially across WooCommerce endpoints, to detect suspicious uploads. Leverage web application firewalls (WAF) to inspect file uploads dynamically.

How to Mitigate CVE-2024-3962

Immediate Actions Required

• Disable file uploads temporarily if not critical to business operations
• Update the plugin to the latest version once a patch is available
• Review server logs for unauthorized access or file uploads

Patch Information

Patch details are available from Themeisle's provided advisory: Patch.

Workarounds

Until a patch is applied, sanitize and validate all file uploads using server-side scripts.

# Configuration example
deny all;

# Validate file types during uploads
audit_log on;
# Allow only specific MIME types
if ($content_type !~ "^application/(zip|pdf)$") {
    return 403;
}