CVE-2024-51793: RepairBuddy RCE Vulnerability

CVE-2024-51793 Overview

CVE-2024-51793 is an unrestricted file upload vulnerability affecting the RepairBuddy (computer-repair-shop) WordPress plugin developed by Webfulcreations. This dangerous flaw allows unauthenticated remote attackers to upload malicious files, including web shells, to vulnerable web servers. Once a web shell is deployed, attackers gain persistent remote access to execute arbitrary commands, exfiltrate data, pivot to internal systems, or fully compromise the hosting environment.

Critical Impact

Unauthenticated remote attackers can upload web shells to achieve full server compromise without any user interaction required.

Affected Products

• Webfulcreations RepairBuddy (computer-repair-shop) plugin for WordPress versions through 3.8115
• WordPress installations running vulnerable versions of the computer-repair-shop plugin
• Web servers hosting affected WordPress sites

Discovery Timeline

• 2024-11-11 - CVE-2024-51793 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-51793

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The RepairBuddy plugin fails to properly validate and sanitize file uploads, allowing attackers to bypass file type restrictions and upload executable PHP files or other dangerous file types to the web server.

The attack can be executed remotely over the network without requiring any authentication or user interaction. Once exploited, attackers achieve complete compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is particularly severe because it enables immediate remote code execution capabilities through uploaded web shells.

A proof-of-concept exploit has been published on GitHub, demonstrating a zero-click RCE attack scenario that requires no victim interaction to achieve code execution.

Root Cause

The root cause of this vulnerability lies in insufficient file upload validation within the RepairBuddy plugin. The plugin fails to implement proper security controls including:

• Missing or inadequate file extension validation
• Lack of MIME type verification
• Absence of file content inspection
• No authentication requirements for upload functionality
• Missing authorization checks on upload endpoints

These deficiencies allow attackers to upload PHP files or other executable scripts that can then be accessed directly through the web server, resulting in arbitrary code execution.

Attack Vector

The attack is conducted remotely over the network (AV:N) with low complexity (AC:L). No privileges are required (PR:N) and no user interaction is needed (UI:N). An attacker identifies a WordPress site running a vulnerable version of the RepairBuddy plugin, then crafts a malicious request to upload a PHP web shell through the vulnerable upload endpoint. Once uploaded, the attacker accesses the web shell URL to execute arbitrary commands on the underlying server.

The exploitation process typically involves:

1. Scanning for WordPress installations with the RepairBuddy plugin
2. Identifying the vulnerable upload endpoint
3. Crafting a request with a malicious PHP file disguised or passed through inadequate validation
4. Uploading the web shell to the server's web-accessible directory
5. Accessing the uploaded file to gain command execution capabilities

Detection Methods for CVE-2024-51793

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin folders
• Web server logs showing POST requests to RepairBuddy plugin upload endpoints followed by GET requests to unusual PHP files
• Presence of common web shell signatures such as eval(), base64_decode(), system(), or exec() in newly created files
• Unusual outbound network connections from the web server process

Detection Strategies

• Monitor file system changes in WordPress wp-content/uploads/ and plugin directories for newly created PHP or executable files
• Implement web application firewall (WAF) rules to detect and block malicious file upload attempts targeting the RepairBuddy plugin
• Deploy file integrity monitoring to alert on unexpected file modifications in WordPress installations
• Analyze web server access logs for patterns indicative of web shell access, such as command parameters in GET/POST requests

Monitoring Recommendations

• Enable verbose logging for all file upload activities in WordPress and review logs regularly
• Configure SIEM alerts for suspicious file creation events in web-accessible directories
• Monitor for unusual process spawning from web server processes (e.g., www-data or apache spawning shell commands)
• Implement network monitoring to detect command-and-control traffic patterns from compromised servers

How to Mitigate CVE-2024-51793

Immediate Actions Required

• Immediately disable or uninstall the RepairBuddy (computer-repair-shop) plugin if running version 3.8115 or earlier
• Scan WordPress installations for existing web shells or unauthorized PHP files in upload directories
• Review web server logs for evidence of exploitation attempts or successful compromises
• If compromise is suspected, perform a full forensic investigation before restoring from known-good backups

Patch Information

At the time of publication, no official patch information has been provided by the vendor. Organizations should monitor the Patchstack vulnerability report for updates on remediation guidance. Consider replacing the vulnerable plugin with an alternative solution that has been properly audited for security vulnerabilities.

Workarounds

• Disable the RepairBuddy plugin entirely until a security patch is available
• Implement server-level restrictions to prevent execution of PHP files in upload directories using .htaccess rules or web server configuration
• Deploy a web application firewall (WAF) with rules to block malicious file upload attempts and web shell access patterns
• Restrict file upload functionality at the server level by disabling PHP execution in user-writable directories

# Apache .htaccess configuration to prevent PHP execution in uploads directory
# Place this file in wp-content/uploads/ directory

<FilesMatch "\.(?:php|phtml|php3|php4|php5|php7|phps)$">
    Require all denied
</FilesMatch>

# Alternative: Disable PHP engine entirely
php_flag engine off