CVE-2024-9290: WordPress Super Backup Plugin RCE Flaw

CVE-2024-9290 Overview

CVE-2024-9290 is a critical arbitrary file upload vulnerability in the Super Backup & Clone - Migrate for WordPress plugin. The vulnerability exists due to missing file type validation and a missing capability check on the ibk_restore_migrate_check() function in all versions up to, and including, 2.3.3. This security flaw allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may enable remote code execution.

Critical Impact

Unauthenticated attackers can upload malicious files to vulnerable WordPress sites, potentially leading to complete server compromise and remote code execution.

Affected Products

• Super Backup & Clone - Migrate for WordPress plugin versions up to and including 2.3.3
• WordPress installations running vulnerable plugin versions

Discovery Timeline

• 2024-12-13 - CVE-2024-9290 published to NVD
• 2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-9290

Vulnerability Analysis

This vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). The ibk_restore_migrate_check() function in the Super Backup & Clone plugin lacks both file type validation and proper capability checks. This dual oversight creates a severe security gap where the function processes file upload requests without verifying whether the requesting user has appropriate WordPress permissions, and without validating whether the uploaded file contains potentially dangerous content.

The absence of authentication requirements means that any remote attacker can interact with this function directly. Combined with the lack of file type restrictions, attackers can upload PHP webshells, backdoors, or other malicious scripts that execute with the privileges of the web server.

Root Cause

The root cause is a combination of two critical security oversights in the plugin's code: the ibk_restore_migrate_check() function fails to implement WordPress capability checks that would restrict access to authorized users, and it does not perform file type validation to ensure only safe file types (such as backup archives) are accepted. This violates the principle of defense in depth by omitting both authentication and input validation controls.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft HTTP requests directly to the vulnerable endpoint, uploading malicious PHP files that bypass any file type restrictions. Once uploaded, the attacker can access the malicious file via the web server to achieve code execution.

The exploitation flow involves:

1. Identifying a WordPress site running a vulnerable version of Super Backup & Clone
2. Crafting a multipart HTTP POST request targeting the ibk_restore_migrate_check() function
3. Including a malicious PHP file (such as a webshell) in the request payload
4. Accessing the uploaded file through the web server to execute arbitrary commands

For detailed technical information, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-9290

Indicators of Compromise

• Unexpected PHP files appearing in WordPress upload directories or plugin folders
• Web server access logs showing POST requests to Super Backup & Clone plugin endpoints from unknown sources
• Newly created files with suspicious names or obfuscated PHP code in the uploads directory
• Unusual outbound network connections from the web server process

Detection Strategies

• Monitor WordPress plugin directories for newly created or modified PHP files that do not match known plugin updates
• Implement web application firewall (WAF) rules to detect and block multipart file upload requests containing PHP content
• Review web server access logs for suspicious requests to /wp-admin/admin-ajax.php with actions related to the Super Backup & Clone plugin
• Use file integrity monitoring tools to detect unauthorized file additions to the WordPress installation

Monitoring Recommendations

• Enable detailed logging for all HTTP POST requests to WordPress AJAX endpoints
• Configure alerts for file creation events in web-accessible directories outside normal content management workflows
• Monitor for PHP process spawning shell commands or making unexpected network connections
• Implement real-time log analysis to detect patterns consistent with webshell deployment and usage

How to Mitigate CVE-2024-9290

Immediate Actions Required

• Update the Super Backup & Clone - Migrate for WordPress plugin to the latest patched version immediately
• Audit WordPress installations for any suspicious files that may have been uploaded through this vulnerability
• Review web server logs for evidence of exploitation attempts targeting the ibk_restore_migrate_check() function
• Consider temporarily disabling the plugin if an update is not yet available

Patch Information

Organizations should update to the latest version of the Super Backup & Clone - Migrate for WordPress plugin that addresses this vulnerability. The plugin is available through CodeCanyon. Verify that any update includes proper capability checks and file type validation in the ibk_restore_migrate_check() function.

Workarounds

• Temporarily deactivate and remove the Super Backup & Clone plugin until a patched version is applied
• Implement WAF rules to block unauthenticated requests to the vulnerable plugin endpoint
• Restrict access to WordPress admin AJAX endpoints at the web server level using IP allowlisting
• Deploy file upload monitoring to detect and alert on any new PHP files created in WordPress directories

# Example: Block access to the plugin via .htaccess (temporary workaround)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/developer-developer-developer-developer/
    RewriteRule .* - [F,L]
</IfModule>