CVE-2024-9162: WP Migration Backup Plugin RCE Vulnerability

CVE-2024-9162 Overview

CVE-2024-9162 is a PHP Code Injection vulnerability affecting the All-in-One WP Migration and Backup plugin for WordPress. The vulnerability exists due to missing file type validation during the export functionality in all versions up to, and including, 7.86. This security flaw allows authenticated attackers with Administrator-level access or above to create an export file with a .php extension on the affected site's server and inject arbitrary PHP code into it, potentially enabling remote code execution.

Critical Impact

Authenticated attackers with administrative privileges can achieve remote code execution by injecting malicious PHP code through the plugin's export functionality, potentially leading to complete site compromise.

Affected Products

• All-in-One WP Migration and Backup plugin for WordPress versions up to and including 7.86
• WordPress installations with the vulnerable plugin installed
• Web servers hosting affected WordPress sites

Discovery Timeline

• October 28, 2024 - CVE-2024-9162 published to NVD
• October 28, 2024 - Last updated in NVD database

Technical Details for CVE-2024-9162

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The All-in-One WP Migration and Backup plugin fails to implement proper file type validation when generating export files. When an administrator initiates an export operation, the plugin does not restrict the file extension of the generated backup file.

This architectural oversight enables an authenticated attacker with administrative privileges to manipulate the export process to create files with executable extensions such as .php. By crafting malicious input during the export operation, an attacker can inject arbitrary PHP code that will be written to the server's file system. Once the malicious PHP file exists on the server, it can be accessed via HTTP request, triggering execution of the injected code within the context of the web server.

Root Cause

The root cause of this vulnerability lies in the absence of file type validation within the export controller logic. The affected code in class-ai1wm-export-controller.php and class-ai1wm-backups-controller.php does not enforce restrictions on the file extension of exported files. Without proper validation to ensure exports use safe, non-executable extensions (such as .wpress), attackers can specify or manipulate the output to create PHP files on the server.

Attack Vector

The attack requires network access and administrative authentication to the WordPress installation. An attacker with compromised or legitimate administrator credentials can exploit this vulnerability through the following attack flow:

1. Authenticate to the WordPress admin panel with administrator-level privileges
2. Access the All-in-One WP Migration plugin's export functionality
3. Manipulate the export request to specify a .php file extension for the output
4. Inject malicious PHP code into the export content
5. The plugin creates the PHP file on the server without validation
6. Access the created PHP file via HTTP to execute the injected code

The vulnerability mechanism involves the export controller accepting user-controlled input without proper sanitization. Technical details and proof-of-concept information are available in the GitHub PoC Repository and the detailed CVE analysis. The vulnerable code paths can be examined in the WordPress plugin source at the export controller and backups controller.

Detection Methods for CVE-2024-9162

Indicators of Compromise

• Unexpected .php files created in the plugin's backup or export directories
• Anomalous HTTP requests to newly created PHP files in WordPress content directories
• Web server logs showing access to suspicious PHP files in wp-content/ai1wm-backups/ or similar paths
• Modified timestamps on files within the All-in-One WP Migration plugin directories

Detection Strategies

• Monitor WordPress admin activity logs for unusual export operations from the All-in-One WP Migration plugin
• Implement file integrity monitoring (FIM) on WordPress directories to detect creation of unauthorized PHP files
• Review web server access logs for requests to PHP files in backup-related directories
• Deploy web application firewall (WAF) rules to detect attempts to create executable files through plugin functionality

Monitoring Recommendations

• Enable WordPress audit logging to track administrative actions and plugin usage
• Configure real-time alerts for new PHP file creation in web-accessible directories
• Implement endpoint detection and response (EDR) solutions to monitor file system changes on web servers
• Regularly audit installed WordPress plugins and their versions against known vulnerability databases

How to Mitigate CVE-2024-9162

Immediate Actions Required

• Update the All-in-One WP Migration and Backup plugin to the latest version immediately
• Audit existing administrator accounts and revoke unnecessary administrative access
• Review web server directories for any suspicious PHP files, particularly in backup-related paths
• Consider temporarily disabling the plugin until a patched version can be verified and installed

Patch Information

Organizations should update to the latest version of the All-in-One WP Migration and Backup plugin that addresses this vulnerability. Detailed vulnerability information and remediation guidance are available in the Wordfence Vulnerability Report. Always verify plugin updates through the official WordPress plugin repository.

Workarounds

• Implement strict file upload and creation restrictions on the web server to prevent PHP file creation in plugin directories
• Apply the principle of least privilege by limiting the number of WordPress administrator accounts
• Configure web server rules to block execution of PHP files in backup and upload directories
• Deploy a web application firewall with rules to detect and block code injection attempts

# Configuration example - Apache .htaccess to prevent PHP execution in backup directories
# Place this in /wp-content/ai1wm-backups/.htaccess
<FilesMatch "\.php$">
    Deny from all
</FilesMatch>

# For Nginx - add to server configuration block
location ~* /wp-content/ai1wm-backups/.*\.php$ {
    deny all;
}