CVE-2024-7772: Jupiter X Core WordPress RCE Vulnerability

CVE-2024-7772 Overview

The Jupiter X Core plugin for WordPress contains a critical arbitrary file upload vulnerability stemming from mishandled file type validation in the validate function. This flaw affects all versions up to and including 4.6.5, allowing unauthenticated attackers to upload malicious files to the affected site's server, potentially enabling remote code execution.

Critical Impact

Unauthenticated attackers can upload arbitrary files to vulnerable WordPress sites, potentially achieving full remote code execution and complete server compromise.

Affected Products

• Artbees Jupiter X Core versions up to and including 4.6.5
• WordPress sites running vulnerable versions of the Jupiter X Core plugin

Discovery Timeline

• 2024-09-26 - CVE-2024-7772 published to NVD
• 2024-10-02 - Last updated in NVD database

Technical Details for CVE-2024-7772

Vulnerability Analysis

This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type. The flaw exists within the file upload handling mechanism of the Jupiter X Core plugin, specifically in the validate function located in the AJAX handler component (ajax-handler.php). The vulnerable code fails to properly validate uploaded file types, creating a critical security gap that can be exploited without any authentication.

The vulnerability allows attackers to bypass intended file type restrictions entirely. When a malicious actor submits a specially crafted upload request, the flawed validation logic permits files with dangerous extensions (such as PHP scripts) to be uploaded to the server. Once a malicious PHP file is uploaded, the attacker can execute arbitrary code on the server by simply accessing the uploaded file's URL.

Root Cause

The root cause lies in improper implementation of the validate function within the forms module's AJAX handler. The validation logic fails to adequately verify file types, allowing attackers to circumvent the intended security controls. This mishandling of file type validation means that dangerous executable files can pass through the upload process unchecked.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker targets the vulnerable file upload endpoint exposed by the Jupiter X Core plugin's forms module. By crafting a malicious request with a file containing executable code (such as a PHP web shell), the attacker can upload the file directly to the WordPress server.

The vulnerability is particularly dangerous because:

• No authentication is required to exploit it
• The attack can be performed remotely over HTTP/HTTPS
• Successful exploitation grants the attacker code execution capabilities on the server

The vulnerable endpoint processes file uploads through the ajax-handler.php component. When the validate function fails to properly check file extensions and MIME types, malicious files are accepted and stored in accessible locations on the server. Technical details of the vulnerability can be found in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-7772

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin folders
• Web server logs showing POST requests to Jupiter X Core AJAX endpoints with file upload parameters
• Presence of web shells or unfamiliar executable files on the server
• Unusual outbound network connections originating from the web server process

Detection Strategies

• Monitor WordPress upload directories for newly created PHP or executable files
• Implement file integrity monitoring on WordPress installations to detect unauthorized file additions
• Review web server access logs for suspicious requests targeting /wp-admin/admin-ajax.php with Jupiter X Core-related actions
• Deploy web application firewall rules to inspect and block malicious file upload attempts

Monitoring Recommendations

• Enable logging for all file upload activities on WordPress installations
• Configure alerts for the creation of executable files in web-accessible directories
• Implement regular automated scans for known web shell signatures
• Monitor server resource utilization for anomalies that may indicate crypto-mining or other malicious activity following compromise

How to Mitigate CVE-2024-7772

Immediate Actions Required

• Update the Jupiter X Core plugin to a version newer than 4.6.5 immediately
• Audit the WordPress installation for any suspicious files that may have been uploaded
• Review server access logs for evidence of exploitation attempts
• If compromise is suspected, consider restoring from a known-clean backup and conducting a thorough security assessment

Patch Information

The vulnerability has been addressed in plugin updates following version 4.6.5. The patch corrects the file type validation logic in the validate function to properly reject dangerous file types. Details of the security fix can be reviewed in the WordPress Changeset Update.

WordPress administrators should update the Jupiter X Core plugin through the WordPress admin dashboard or by downloading the latest version from the official WordPress plugin repository.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the Jupiter X Core plugin until an update can be applied
• Implement server-level restrictions to prevent execution of PHP files in upload directories using .htaccess rules or web server configuration
• Deploy a Web Application Firewall (WAF) with rules to block suspicious file upload attempts
• Restrict access to WordPress admin-ajax.php endpoints from untrusted IP addresses if feasible

# Apache .htaccess workaround to prevent PHP execution in uploads directory
# Add to wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|php[0-9])$">
    Require all denied
</FilesMatch>