CVE-2024-5153: Startklar Elementor Path Traversal Flaw

CVE-2024-5153 Overview

The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the dropzone_hash parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary files on the server, which can contain sensitive information, and to delete arbitrary directories, including the root WordPress directory.

Critical Impact

This vulnerability allows unauthenticated attackers to both access and delete sensitive files on the server, potentially compromising the entire WordPress installation.

Affected Products

• Web-shop-host Startklar Elmentor Addons 1.7.15

Discovery Timeline

• Not Available - Vulnerability discovered by Not Available
• Not Available - Responsible disclosure to web-shop-host
• Not Available - CVE CVE-2024-5153 assigned
• Not Available - Web-shop-host releases security patch
• 2024-06-06T04:15:13.950 - CVE CVE-2024-5153 published to NVD
• 2024-11-21T09:47:04.837 - Last updated in NVD database

Technical Details for CVE-2024-5153

Vulnerability Analysis

This directory traversal vulnerability is facilitated through the dropzone_hash parameter. Insufficient input validation allows malicious actors to access unauthorized areas of the filesystem.

Root Cause

The root cause is a failure to properly sanitize the dropzone_hash parameter, allowing traversal of directories beyond the intended scope.

Attack Vector

Network-based attack that can be conducted by unauthorized users who can craft HTTP requests containing malicious directory traversal sequences.

// Example exploitation code (sanitized)
$malicious_payload = '../../../etc/passwd';
$url = "http://example.com/wp-content/plugins/startklar_elmentor_addons/dropzone.php?dropzone_hash="$malicious_payload;
$response = file_get_contents($url);
echo $response;

Detection Methods for CVE-2024-5153

Indicators of Compromise

• Unexpected access attempts to sensitive files like /etc/passwd
• Inexplicable deletion of directories or files
• Suspicious HTTP requests containing directory traversal patterns

Detection Strategies

Implement monitoring for unusual patterns in HTTP request logs, especially those containing traversal sequences. Integrate checks for unauthorized file accessed warnings in server logs.

Monitoring Recommendations

Use intrusion detection systems (IDS) to alert on directory traversal patterns. Additionally, incorporate frequent log file analysis to detect unauthorized file manipulation activities.

How to Mitigate CVE-2024-5153

Immediate Actions Required

• Update to the latest version of the plugin when a patch is available
• Regularly back up valuable data and website configuration
• Restrict public access to critical files via server configurations

Patch Information

Currently, no patch is available. Monitoring vendor sources for an update is recommended.

Workarounds

Implement additional rules in .htaccess or nginx configurations to block directory traversal sequences.

# Configuration example for Apache
<Directory "/var/www/html">
    Options -Indexes
    RewriteEngine On
    RewriteCond %{QUERY_STRING} "(\.|%0A|%0D|%00|%01|%02|%03|%04|%252e)"
    RewriteRule ^(.*)$ - [F]
</Directory>