CVE-2024-7627: Bitapps File Manager RCE Vulnerability

CVE-2024-7627 Overview

CVE-2024-7627 is a Remote Code Execution (RCE) vulnerability in the Bit File Manager plugin for WordPress, affecting versions 6.0 through 6.5.5. The flaw resides in the checkSyntax function, which writes a temporary file to a publicly accessible directory before performing file validation. This race condition allows unauthenticated attackers to execute arbitrary PHP code on the server when an administrator has enabled Guest User read permissions. The vulnerability is tracked under [CWE-94] (Code Injection) and [CWE-362] (Race Condition). A public proof-of-concept exploit is available on GitHub.

Critical Impact

Unauthenticated attackers can achieve remote code execution on WordPress sites running vulnerable Bit File Manager installations with Guest User read permissions enabled.

Affected Products

• Bit Apps File Manager plugin for WordPress, versions 6.0 through 6.5.5
• WordPress installations with Bit File Manager configured to allow Guest User read permissions
• Any web server hosting the vulnerable plugin with public directory write access

Discovery Timeline

• 2024-09-05 - CVE-2024-7627 published to NVD
• 2024-09-11 - Last updated in NVD database

Technical Details for CVE-2024-7627

Vulnerability Analysis

The Bit File Manager plugin exposes a checkSyntax function within FileEditValidator.php that handles syntax validation of PHP files. The function writes user-supplied content to a temporary file inside a publicly accessible directory before invoking PHP's syntax checker. Attackers exploit the brief window between file creation and validation by requesting the temporary file directly through the web server.

The race condition results in the PHP interpreter executing attacker-controlled code. When Guest User read permissions are enabled, the attacker does not need authentication credentials to trigger the flow. Successful exploitation grants the attacker code execution under the web server user context.

Root Cause

The root cause is improper sequencing of file write and validation operations [CWE-362] combined with code injection [CWE-94]. The vulnerable code path in FileEditValidator.php at lines 39 and 88 stores the file in a web-accessible location instead of an isolated temporary directory outside the document root. No randomization or access control protects the temporary file during the validation window.

Attack Vector

The attack vector is network-based and requires no authentication when Guest User read permissions are enabled. Attackers submit a syntax-check request containing PHP payload content, then race to access the temporary file via HTTP before validation completes or the file is removed. The attack complexity is high because exploitation depends on winning the race condition.

# Public proof-of-concept exploit retrieval
wget https://raw.githubusercontent.com/siunam321/CVE-2024-7627-PoC/main/poc.py

Source: siunam321/CVE-2024-7627-PoC — verified public PoC repository

Detection Methods for CVE-2024-7627

Indicators of Compromise

• Unexpected PHP files appearing under the Bit File Manager plugin directory or wp-content/uploads/ paths
• HTTP POST requests to the plugin's checkSyntax endpoint followed by rapid GET requests to temporary file paths
• Web server access logs showing requests with .php extensions from unauthenticated sessions targeting plugin directories
• Outbound network connections from the PHP-FPM or web server process to attacker-controlled infrastructure

Detection Strategies

• Monitor WordPress plugin directories for newly created files with executable extensions outside scheduled deployments
• Inspect web server access logs for repeated, near-simultaneous requests to the same temporary filename, indicating race condition exploitation attempts
• Deploy file integrity monitoring on the wp-content/plugins/file-manager/ directory tree
• Alert on PHP processes spawning shells (sh, bash) or network utilities (curl, wget, nc)

Monitoring Recommendations

• Enable verbose access logging on the WordPress installation to capture full URI and POST metadata
• Forward web server and PHP error logs to a centralized SIEM for correlation across the plugin attack surface
• Track changes to Bit File Manager configuration, specifically the Guest User permission settings
• Audit administrator activity for permission changes that expose the plugin to unauthenticated users

How to Mitigate CVE-2024-7627

Immediate Actions Required

• Update the Bit File Manager plugin to version 6.5.6 or later immediately
• Disable Guest User read permissions in the plugin configuration until the patch is applied
• Audit the WordPress installation for unauthorized PHP files created since plugin deployment
• Rotate WordPress administrator credentials and review installed plugins for unauthorized modifications

Patch Information

The vendor released a fix in changeset 3138710 on the WordPress plugin repository. The patch modifies the FileEditValidator.php logic to prevent the temporary file from being written to a publicly accessible location. Refer to the Wordfence Vulnerability Report for complete remediation guidance.

Workarounds

• Disable the Bit File Manager plugin entirely if a patch cannot be applied immediately
• Block public access to the plugin's temporary file paths using a web application firewall (WAF) rule
• Revoke Guest User read permissions in the plugin's role management interface
• Restrict access to the WordPress administrative directories using IP allowlists at the web server level

# Update Bit File Manager via WP-CLI to the patched version
wp plugin update file-manager --version=6.5.6

# Verify the installed version after update
wp plugin get file-manager --field=version