CVE-2024-4371: CoDesigner WordPress Plugin RCE Vulnerability

CVE-2024-4371 Overview

The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.4.1 via deserialization of untrusted input from the recently_viewed_products cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Critical Impact
This vulnerability allows for potential remote code execution through PHP Object Injection, posing significant risk to affected systems.

Affected Products

Codexpert Codesigner

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to Codexpert
Not Available - CVE CVE-2024-4371 assigned
Not Available - Codexpert releases security patch
2024-06-13 - CVE CVE-2024-4371 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4371

Vulnerability Analysis

This vulnerability arises from the deserialization of untrusted data in the WordPress plugin. Specifically, the recently_viewed_products cookie can be manipulated by an attacker to perform PHP Object Injection.

Root Cause

The root cause is improper validation of data passed into the deserialization process, allowing attackers to inject specially crafted serialized objects.

Attack Vector

The vulnerability can be exploited over a network by manipulating the recently_viewed_products cookie sent by users visiting a WordPress site utilizing the vulnerable plugin.

php

// Example exploitation code (sanitized)
$cookie_value = 'O:8:"Exploit":1:{s:4:"file";s:12:"/etc/passwd";}';
setcookie('recently_viewed_products', $cookie_value);

Detection Methods for CVE-2024-4371

Indicators of Compromise

Unexpected entries in application logs
Unrecognized serialized PHP objects in cookies
Anomalous file access patterns

Detection Strategies

Implement application-layer monitoring to inspect cookie contents for serialized objects. Employ anomaly detection systems to flag deviations in typical access patterns or unusual serialized data.

Monitoring Recommendations

Enable detailed logging for cookie data and monitor for unusual serialized object signatures. Utilize endpoint detection solutions such as SentinelOne to detect and isolate suspicious activities related to PHP object injection.

How to Mitigate CVE-2024-4371

Immediate Actions Required

Disable the Codexpert Codesigner plugin until a patch is applied
Implement strict input validation measures
Harden PHP configuration to disable dangerous PHP functions

Patch Information

Contact the vendor Codexpert for availability of patches or updates that address this vulnerability.

Workarounds

Apply input filtering to ensure only expected data types and structures are processed. Consider disabling or replacing the feature utilizing the recently_viewed_products cookie until a patch is provided.

bash

# Configuration example to disable dangerous PHP functions
echo 'disable_functions = "exec,passthru,shell_exec,system"' >> /etc/php.ini
service php-fpm restart