CVE-2024-5932: GiveWP Donation Plugin RCE Vulnerability

CVE-2024-5932 Overview

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress contains a critical PHP Object Injection vulnerability affecting all versions up to and including 3.14.1. The vulnerability exists due to insecure deserialization of untrusted input from the give_title parameter. This flaw allows unauthenticated attackers to inject arbitrary PHP objects, and when combined with an available Property-Oriented Programming (POP) chain present in the plugin, enables remote code execution and arbitrary file deletion.

Critical Impact

Unauthenticated attackers can achieve remote code execution and delete arbitrary files on vulnerable WordPress sites running GiveWP plugin versions up to 3.14.1, potentially compromising over 100,000 WordPress installations.

Affected Products

• GiveWP Donation Plugin and Fundraising Platform for WordPress versions ≤ 3.14.1
• WordPress sites with vulnerable GiveWP plugin installed
• All GiveWP installations prior to the security patch release

Discovery Timeline

• August 20, 2024 - CVE-2024-5932 published to NVD
• August 26, 2024 - Last updated in NVD database

Technical Details for CVE-2024-5932

Vulnerability Analysis

This vulnerability is classified as a PHP Object Injection (CWE-502: Deserialization of Untrusted Data). The GiveWP plugin fails to properly validate and sanitize user-supplied input before passing it to PHP's unserialize function. The vulnerable code path processes the give_title parameter without adequate input validation, allowing attackers to inject serialized PHP objects.

What makes this vulnerability particularly severe is the presence of a complete POP (Property-Oriented Programming) chain within the plugin's codebase and its dependencies. Multiple files contribute to this attack chain, including components in login-register.php, process-donation.php, the AvatarRoute.php file within the Donor Dashboards module, and third-party libraries like TCPDF and FakerPHP. When exploited, the POP chain allows attackers to execute arbitrary code on the server and delete critical files.

The vulnerability requires no authentication, meaning any remote attacker can exploit it over the network without valid credentials, making it exceptionally dangerous for internet-facing WordPress installations.

Root Cause

The root cause of this vulnerability lies in the unsafe deserialization of user-controlled input. The GiveWP plugin processes the give_title parameter through PHP's unserialize() function without proper input validation or type checking. This allows attackers to pass maliciously crafted serialized data that, when deserialized, instantiates arbitrary objects with attacker-controlled properties.

The presence of exploitable "gadget" classes within the plugin's dependency chain (including TCPDF and FakerPHP libraries) provides the necessary POP chain for achieving code execution. The ValidGenerator.php file from FakerPHP, in particular, has been identified as containing exploitable magic methods that can be leveraged in the attack chain.

Attack Vector

The attack is conducted over the network and requires no authentication or user interaction. An attacker can craft a malicious HTTP request containing a serialized PHP object payload in the give_title parameter. When the GiveWP plugin processes this request, the malicious object is deserialized, triggering the POP chain and executing arbitrary code.

The attack flow involves:

1. Crafting a serialized PHP object that leverages available gadget classes
2. Sending the payload via the give_title parameter in a donation-related request
3. The plugin deserializes the malicious input without validation
4. PHP magic methods in the gadget chain execute attacker-controlled code
5. The attacker achieves remote code execution or arbitrary file deletion

Detection Methods for CVE-2024-5932

Indicators of Compromise

• Unexpected or anomalous POST requests to donation processing endpoints containing serialized PHP objects
• Suspicious give_title parameter values containing PHP serialization patterns (strings starting with O:, a:, or s:)
• Unusual file deletions or modifications on the WordPress server
• Web server logs showing requests with unusually long or encoded give_title values
• Creation of new files or unexpected code execution artifacts on the server

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in request parameters
• Monitor HTTP request logs for the give_title parameter containing suspicious serialization signatures
• Deploy file integrity monitoring to detect unauthorized modifications or deletions
• Analyze web server access logs for anomalous donation processing requests
• Use intrusion detection systems configured to alert on PHP object injection attack patterns

Monitoring Recommendations

• Enable verbose logging for all GiveWP plugin activities and donation processing endpoints
• Configure real-time alerting for any detected PHP serialization patterns in user input
• Monitor for unexpected process spawning from web server processes
• Implement network traffic analysis to detect potential data exfiltration following compromise
• Establish baseline behavior for donation processing to identify anomalous activity

How to Mitigate CVE-2024-5932

Immediate Actions Required

• Update GiveWP plugin to version 3.14.2 or later immediately
• Review server logs for any indicators of exploitation attempts
• Conduct a security audit of WordPress installations running GiveWP
• Implement WAF rules to block PHP object injection attempts as an interim measure
• If immediate patching is not possible, consider temporarily disabling the GiveWP plugin

Patch Information

The GiveWP development team has released a security update to address this vulnerability. The fix is available in the WordPress Changeset Update. Administrators should update to the latest version of GiveWP immediately through the WordPress plugin management interface or by downloading the patched version directly from the WordPress plugin repository.

For detailed technical information about this vulnerability, refer to the Wordfence Blog on RCE Vulnerability and the Wordfence CVE Vulnerability Intelligence.

Workarounds

• Deploy a WAF with rules specifically designed to detect and block PHP serialized object patterns in request parameters
• Implement server-side input validation to reject requests containing potential serialization signatures
• Restrict access to donation processing endpoints using IP allowlisting where feasible
• Consider disabling the GiveWP plugin entirely until patching can be completed on critical production systems
• Use WordPress security plugins that provide virtual patching capabilities for known vulnerabilities

# Example WAF rule pattern to detect PHP object injection attempts
# Add to .htaccess or web server configuration
RewriteEngine On
RewriteCond %{QUERY_STRING} (O:|a:|s:)[0-9]+: [NC,OR]
RewriteCond %{REQUEST_BODY} (O:|a:|s:)[0-9]+: [NC]
RewriteRule .* - [F,L]