CVE-2024-50523: Rainbow-link All Post Contact Form RCE

CVE-2024-50523 Overview

CVE-2024-50523 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the All Post Contact Form WordPress plugin developed by RainbowLink Inc. This vulnerability allows unauthenticated attackers to upload arbitrary files, including web shells, to a vulnerable web server. The flaw stems from insufficient file type validation in the plugin's upload functionality, enabling attackers to bypass security restrictions and execute malicious code on the target system.

Critical Impact

This vulnerability enables unauthenticated remote attackers to upload web shells and gain complete control over vulnerable WordPress installations, potentially leading to full server compromise, data theft, and lateral movement within the hosting environment.

Affected Products

• Rainbow-link All Post Contact Form versions up to and including 1.8.2
• WordPress installations using the allpost-contactform plugin
• All web servers hosting affected versions of this plugin

Discovery Timeline

• 2024-11-04 - CVE-2024-50523 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-50523

Vulnerability Analysis

This vulnerability falls under the Unrestricted Upload of File with Dangerous Type category, which represents a severe security flaw in web applications. The All Post Contact Form plugin fails to properly validate and sanitize uploaded files, allowing attackers to upload executable scripts such as PHP web shells. Once uploaded, these malicious files can be accessed directly via the web server, providing attackers with remote code execution capabilities.

The vulnerability is particularly dangerous because it requires no authentication or user interaction to exploit. An attacker can directly interact with the vulnerable upload endpoint and submit malicious files without needing valid credentials. This allows for automated exploitation at scale across WordPress installations running the vulnerable plugin versions.

Root Cause

The root cause of this vulnerability is the absence of proper file type validation and sanitization mechanisms within the plugin's file upload handler. The plugin fails to:

1. Validate file extensions against a strict allowlist of safe file types
2. Verify the actual MIME type of uploaded files beyond relying on client-supplied headers
3. Sanitize filenames to prevent directory traversal or extension manipulation
4. Store uploaded files outside the web-accessible directory or with non-executable permissions

These oversights allow attackers to upload PHP files or other server-side scripts that the web server will execute when accessed.

Attack Vector

The attack can be performed remotely over the network without any authentication requirements. An attacker crafts a malicious HTTP request containing a web shell or other executable payload disguised as a legitimate file upload through the contact form functionality. The vulnerable plugin accepts and stores this file in a web-accessible location, after which the attacker can execute arbitrary commands on the server by directly accessing the uploaded script.

A typical attack flow involves:

1. Identifying a WordPress site running the vulnerable All Post Contact Form plugin
2. Crafting a multipart form request with a PHP web shell as the uploaded file
3. Submitting the request to the plugin's upload endpoint
4. Locating the uploaded file in the predictable upload directory
5. Accessing the web shell to execute arbitrary commands

Due to the sensitive nature of this vulnerability and the absence of verified proof-of-concept code, specific exploitation details are omitted. Technical information about this vulnerability is available in the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-50523

Indicators of Compromise

• Unexpected PHP files or scripts in the WordPress uploads directory, particularly within plugin-specific folders
• Web server access logs showing requests to unusual or newly created PHP files in the uploads directory
• Outbound network connections from the web server process to unknown external IP addresses
• Suspicious process execution originating from the web server user account

Detection Strategies

• Monitor file creation events in WordPress upload directories for executable file types (.php, .phtml, .phar)
• Implement web application firewall (WAF) rules to block file uploads containing PHP code or suspicious patterns
• Deploy integrity monitoring solutions to detect unauthorized file changes in plugin directories
• Review web server logs for POST requests to the All Post Contact Form upload endpoints followed by GET requests to newly created files

Monitoring Recommendations

• Enable real-time file integrity monitoring on all WordPress plugin and upload directories
• Configure alerts for any new file creation with executable extensions in web-accessible directories
• Implement behavioral analysis to detect anomalous process spawning from web server processes
• Monitor for indicators of web shell activity such as encoded command parameters or shell command patterns in HTTP requests

How to Mitigate CVE-2024-50523

Immediate Actions Required

• Immediately deactivate and remove the All Post Contact Form plugin if running version 1.8.2 or earlier
• Audit the WordPress uploads directory and plugin folders for any suspicious or recently modified files
• Review web server logs for evidence of exploitation attempts or unauthorized file uploads
• Consider temporarily restricting PHP execution in the uploads directory at the web server level

Patch Information

At the time of publication, no official patch has been identified for this vulnerability. Website administrators should consider removing the vulnerable plugin entirely and seeking alternative contact form solutions with a stronger security track record. Monitor the WordPress plugin repository and vendor communications for security updates.

Workarounds

• Remove the All Post Contact Form plugin and migrate to a well-maintained alternative contact form plugin
• Configure the web server to deny PHP execution within the WordPress uploads directory using .htaccess rules or server configuration
• Implement a Web Application Firewall (WAF) with rules to block file upload attacks targeting WordPress plugins
• Restrict file upload functionality to authenticated users only at the server or application level

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in wp-content/uploads/.htaccess

<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phar|pl|py|cgi)$">
    Require all denied
</FilesMatch>

# Alternative: Deny all script execution
<Files *.php>
    deny from all
</Files>