CVE-2024-6386: WPML Plugin RCE Vulnerability via Twig SSTI

CVE-2024-6386 Overview

The WPML plugin for WordPress contains a critical Remote Code Execution (RCE) vulnerability stemming from a Server-Side Template Injection (SSTI) flaw in the Twig templating engine. This vulnerability affects all versions up to and including 4.6.12 and allows authenticated attackers with Contributor-level access or above to execute arbitrary code on the server.

WPML is one of the most popular multilingual plugins for WordPress, used on over one million websites to translate content and manage multilingual functionality. The severity of this vulnerability is amplified by its widespread deployment across enterprise and high-traffic WordPress installations.

Critical Impact

Authenticated attackers with Contributor-level access can achieve full Remote Code Execution on vulnerable WordPress servers, potentially leading to complete site compromise, data exfiltration, and lateral movement within hosting environments.

Affected Products

• WPML WordPress Plugin versions up to and including 4.6.12
• WordPress installations using vulnerable WPML versions
• All WordPress sites with Contributor or higher user roles enabled

Discovery Timeline

• 2024-08-21 - CVE-2024-6386 published to NVD
• 2024-09-27 - Last updated in NVD database

Technical Details for CVE-2024-6386

Vulnerability Analysis

This vulnerability is classified as a Server-Side Template Injection (SSTI) flaw within the Twig templating engine integration used by WPML. The root cause lies in the render function, which fails to properly validate and sanitize user-supplied input before processing it through the Twig template engine.

Twig is a modern PHP templating engine that, when improperly configured, can be exploited to execute arbitrary PHP code. The WPML plugin's implementation allows authenticated users with Contributor-level permissions to inject malicious Twig template syntax that gets processed server-side, resulting in code execution.

The attack can be executed remotely over the network and requires only low-privilege authentication (Contributor role), making it accessible to a broad range of potential attackers including compromised contributor accounts, malicious insiders, or attackers who have obtained valid credentials through other means.

Root Cause

The vulnerability stems from missing input validation and sanitization in the WPML plugin's render function. When processing content through Twig templates, the function accepts user-controlled input without properly filtering dangerous template directives. This allows attackers to inject Twig-specific syntax that can break out of the template context and execute arbitrary PHP code.

The lack of sandbox restrictions on the Twig environment further exacerbates the issue, as attackers can access dangerous functions and classes that would normally be restricted in a properly secured template configuration.

Attack Vector

The attack leverages the Twig SSTI vulnerability through content that gets processed by the render function. An attacker with Contributor-level access can craft malicious content containing Twig template directives designed to execute arbitrary PHP code.

A typical SSTI attack against Twig involves injecting special template syntax to access the underlying PHP environment. Attackers can use Twig's filter and function mechanisms to access the PHP environment and execute system commands or PHP code.

For detailed technical analysis of this vulnerability, refer to the Stealthcopter RCE Analysis which provides comprehensive exploitation details.

Detection Methods for CVE-2024-6386

Indicators of Compromise

• Unusual Twig template syntax appearing in WordPress content fields or database entries
• Unexpected outbound network connections from the web server
• New files created in WordPress directories with suspicious content or PHP code
• Web server logs showing requests with Twig-specific syntax patterns such as {{, {%, or filter chains
• Modified WordPress core files or plugin files outside of normal update processes

Detection Strategies

• Monitor WordPress content submissions for Twig template injection patterns including double curly braces and template directives
• Implement Web Application Firewall (WAF) rules to detect SSTI payloads targeting Twig template syntax
• Review audit logs for Contributor-level users creating or modifying content with unusual template syntax
• Deploy file integrity monitoring to detect unauthorized modifications to WordPress files

Monitoring Recommendations

• Enable detailed WordPress activity logging for all user actions, particularly content creation and modification
• Implement real-time alerting for suspicious patterns in HTTP request bodies targeting WPML endpoints
• Monitor system call activity on web servers for unexpected process execution patterns
• Review WPML plugin error logs for template rendering failures that may indicate exploitation attempts

How to Mitigate CVE-2024-6386

Immediate Actions Required

• Update WPML plugin to version 4.6.13 or later immediately
• Audit all Contributor and higher-level user accounts for unauthorized access or suspicious activity
• Review recently created or modified content for potential SSTI payloads
• Consider temporarily disabling Contributor access if immediate patching is not possible
• Implement WAF rules to block common Twig SSTI patterns as a defense-in-depth measure

Patch Information

The WPML development team has released version 4.6.13 which addresses this vulnerability by implementing proper input validation and sanitization in the render function. Users should update through the WordPress admin panel or download the latest version from the WPML Official Site.

Additional vulnerability details and remediation guidance can be found in the Wordfence Vulnerability Report.

Workarounds

• Restrict Contributor-level access to trusted users only until patching is complete
• Implement server-side input filtering to block Twig template syntax in user-submitted content
• Deploy a Web Application Firewall with SSTI detection capabilities
• Consider using a WordPress security plugin with real-time threat detection to monitor for exploitation attempts
• Temporarily disable WPML functionality if the plugin is not immediately required and patching is delayed

# Configuration example - WAF rule to block common Twig SSTI patterns
# Add to .htaccess or web server configuration
# Block requests containing common Twig injection patterns
RewriteEngine On
RewriteCond %{QUERY_STRING} (\{\{|\{%|__class__|__mro__|__subclasses__) [NC,OR]
RewriteCond %{REQUEST_BODY} (\{\{|\{%|__class__|__mro__|__subclasses__) [NC]
RewriteRule .* - [F,L]