CVE-2024-4345: Startklar Elementor Addons RCE Vulnerability

CVE-2024-4345 Overview

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the process function within the startklarDropZoneUploadProcess class. This vulnerability affects versions up to and including 1.7.13, enabling unauthenticated attackers to upload arbitrary files on the affected site's server, which may result in remote code execution.

Critical Impact

Unauthenticated remote attackers can upload malicious files including PHP web shells to vulnerable WordPress installations, potentially leading to complete site compromise and server takeover.

Affected Products

• Startklar Elementor Addons plugin for WordPress versions up to and including 1.7.13
• WordPress installations running vulnerable versions of the plugin

Discovery Timeline

• 2024-05-07 - CVE-2024-4345 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4345

Vulnerability Analysis

This vulnerability represents a classic arbitrary file upload flaw stemming from inadequate server-side validation of uploaded file types. The startklarDropZoneUploadProcess class implements a file upload handler for the Elementor-based form widgets, but fails to properly restrict the types of files that can be uploaded through the process function.

When a form submission includes file uploads, the vulnerable code path processes the incoming files without adequately verifying that only safe file types (such as images or documents) are accepted. This oversight allows attackers to upload executable files, particularly PHP scripts, which can then be accessed directly through the web server to execute arbitrary code.

The vulnerability is particularly severe because it requires no authentication—any remote attacker can exploit this flaw simply by crafting malicious HTTP requests to the affected endpoint.

Root Cause

The root cause lies in insufficient file type validation within the process function of the startklarDropZoneUploadProcess class. The code fails to implement proper server-side checks to validate file extensions, MIME types, and file content. This type of vulnerability typically occurs when developers rely solely on client-side validation or fail to implement a proper allowlist of permitted file types, allowing attackers to bypass restrictions and upload executable content.

Attack Vector

The attack is network-based and can be executed remotely without any user interaction or authentication requirements. An attacker would typically:

1. Identify a WordPress site running the vulnerable Startklar Elementor Addons plugin
2. Craft a malicious HTTP POST request targeting the file upload endpoint
3. Upload a PHP web shell or other malicious script disguised or submitted directly
4. Access the uploaded file through the web server to execute arbitrary commands
5. Establish persistent access to the compromised server

The vulnerability can be exploited by sending a specially crafted multipart form request to the vulnerable endpoint, bypassing any client-side restrictions that may exist.

Detection Methods for CVE-2024-4345

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin folders
• Suspicious file names with double extensions (e.g., image.php.jpg) or randomized names
• Web shell artifacts such as files containing eval(), base64_decode(), system(), or shell_exec() functions
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor WordPress upload directories for newly created PHP or executable files
• Implement Web Application Firewall (WAF) rules to detect and block suspicious file upload attempts
• Review web server access logs for POST requests to the Startklar Elementor Addons upload endpoints
• Scan for known web shell signatures and suspicious file patterns in WordPress directories

Monitoring Recommendations

• Configure real-time file integrity monitoring on WordPress installations
• Set up alerts for HTTP requests containing suspicious file upload patterns targeting form processing endpoints
• Monitor server processes for unusual child processes spawned by the web server
• Enable detailed logging for form submissions and file upload activities

How to Mitigate CVE-2024-4345

Immediate Actions Required

• Update the Startklar Elementor Addons plugin to the latest patched version immediately
• Audit WordPress upload directories for any suspicious or unexpected files
• If an update is not immediately possible, consider temporarily disabling the plugin until the patch can be applied
• Implement WAF rules to block malicious file upload attempts as an additional layer of defense

Patch Information

The vulnerability has been addressed in versions after 1.7.13 of the Startklar Elementor Addons plugin. The patch implements proper file type validation to prevent arbitrary file uploads. Review the WordPress Plugin Changeset for detailed information about the security fix. Additional details can be found in the Wordfence Vulnerability Report.

Workarounds

• Disable the file upload functionality in Startklar Elementor Addons forms until the plugin is updated
• Implement server-level restrictions to prevent PHP execution in upload directories using .htaccess rules
• Use a security plugin or WAF to block suspicious file upload requests
• Restrict access to form endpoints via IP allowlisting if the forms are only needed for internal users

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

# Alternative: Disable script execution entirely
<IfModule mod_php.c>
    php_flag engine off
</IfModule>