CVE-2024-6164: Ymc-22 Filter & Grids RCE Vulnerability

CVE-2024-6164 Overview

The Filter & Grids WordPress plugin before version 2.8.33 contains a Local File Inclusion (LFI) vulnerability in the post_layout parameter. This security flaw allows unauthenticated attackers to include and execute arbitrary PHP files on the server, enabling remote code execution without requiring any authentication or user interaction.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to execute arbitrary PHP code on vulnerable WordPress installations, potentially leading to complete site compromise, data theft, malware injection, and use of the server for further attacks.

Affected Products

• Filter & Grids WordPress plugin versions prior to 2.8.33
• WordPress installations using vulnerable versions of the YMC-22 Filter & Grids plugin

Discovery Timeline

• 2024-07-18 - CVE-2024-6164 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-6164

Vulnerability Analysis

This vulnerability falls under the Local File Inclusion (LFI) category (CWE-22: Improper Limitation of a Pathname to a Restricted Directory). The flaw exists in how the plugin handles the post_layout parameter, which fails to properly sanitize user-supplied input before using it to include PHP files.

Due to missing or inadequate input validation, an attacker can manipulate the post_layout parameter to traverse directories and include arbitrary PHP files present on the server. When combined with other techniques such as log poisoning or uploading malicious files through other means, this can escalate to full remote code execution.

The vulnerability is particularly severe because it requires no authentication, allowing any remote attacker to exploit it simply by sending a crafted request to the vulnerable endpoint.

Root Cause

The root cause is insufficient input validation and sanitization on the post_layout parameter within the Filter & Grids plugin. The plugin directly uses user-controllable input in file inclusion operations without properly restricting the path to authorized directories or validating that the requested file is an expected layout template.

This represents a classic path traversal weakness where directory traversal sequences (such as ../) can be used to escape the intended directory and access files elsewhere on the filesystem.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to a WordPress site running the vulnerable plugin version. The attack workflow typically involves:

1. Identifying a WordPress site using Filter & Grids plugin prior to version 2.8.33
2. Crafting a malicious request with a manipulated post_layout parameter containing directory traversal sequences
3. Including a PHP file that either already exists on the server (such as configuration files or logs) or has been placed there through another vector
4. Achieving code execution when the PHP file is processed by the server

For detailed technical information, refer to the WPScan Vulnerability Assessment.

Detection Methods for CVE-2024-6164

Indicators of Compromise

• Unusual HTTP requests containing directory traversal patterns (../) in the post_layout parameter
• Web server access logs showing repeated requests to Filter & Grids plugin endpoints with path manipulation attempts
• Unexpected PHP error messages or warnings related to file inclusion
• New or modified PHP files appearing in unexpected directories

Detection Strategies

• Monitor web server access logs for requests containing post_layout parameter with path traversal sequences
• Implement Web Application Firewall (WAF) rules to detect and block LFI attack patterns
• Use WordPress security plugins to scan for known vulnerable plugin versions
• Deploy file integrity monitoring to detect unauthorized file modifications

Monitoring Recommendations

• Enable detailed logging on WordPress installations and review for anomalous activity
• Configure alerts for HTTP requests containing common LFI patterns targeting WordPress plugin endpoints
• Regularly audit installed WordPress plugins against vulnerability databases
• Monitor for unexpected outbound connections from the web server that might indicate post-exploitation activity

How to Mitigate CVE-2024-6164

Immediate Actions Required

• Update Filter & Grids plugin to version 2.8.33 or later immediately
• Review web server access logs for signs of exploitation attempts
• Conduct a security audit of the WordPress installation if exploitation is suspected
• Consider temporarily disabling the plugin until the update can be applied

Patch Information

The vulnerability has been addressed in Filter & Grids plugin version 2.8.33. WordPress administrators should update to this version or later through the WordPress plugin admin interface or by downloading the latest version from the official WordPress plugin repository.

For additional vulnerability details, see the WPScan Vulnerability Assessment.

Workarounds

• Implement WAF rules to block requests containing path traversal patterns in the post_layout parameter
• Restrict access to WordPress admin and plugin endpoints using IP-based access controls
• Disable the Filter & Grids plugin temporarily if updating is not immediately possible
• Use server-side configurations to disable PHP execution in upload directories

# Apache .htaccess configuration to block common LFI patterns
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
    RewriteCond %{QUERY_STRING} (post_layout=.*\.\.) [NC]
    RewriteRule .* - [F,L]
</IfModule>