CVE-2024-9669: Ninjateam Filester RCE Vulnerability

CVE-2024-9669 Overview

CVE-2024-9669 is a Local JavaScript File Inclusion vulnerability in the File Manager Pro – Filester plugin for WordPress. The flaw exists in all versions up to and including 1.8.5 and is triggered through the fm_locale parameter. Authenticated attackers with Administrator-level access or higher can include and execute arbitrary files on the server. The issue was partially patched in version 1.8.5. The vulnerability is tracked under CWE-22 (Path Traversal) and was published to the National Vulnerability Database on November 28, 2024.

Critical Impact
Attackers with administrator privileges can execute arbitrary code, bypass access controls, and exfiltrate sensitive data by including previously uploaded files such as images.

Affected Products

Ninjateam Filester (File Manager Pro) plugin for WordPress
All versions up to and including 1.8.5
WordPress installations using ninjateam:filester

Discovery Timeline

2024-11-28 - CVE-2024-9669 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9669

Vulnerability Analysis

The Filester plugin loads locale files using the user-supplied fm_locale parameter without adequate sanitization. The parameter is used to construct a file path that is subsequently included by the plugin's file manager view. Because the value is not restricted to a whitelist of expected locale identifiers, attackers can traverse the filesystem and include arbitrary local files with a .js extension or, in certain scenarios, other file types staged on the server.

The inclusion occurs in server-side PHP code, referenced in the FileManager.php source and the html-filemanager.php view. Because the plugin exposes a file upload interface, attackers can upload seemingly benign files such as images containing embedded payloads and then include them through the vulnerable parameter to achieve code execution.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory, classified as CWE-22. The fm_locale parameter accepts user-controlled input that is concatenated into a filesystem path used by an include statement. Missing input validation and the absence of an allowlist of valid locale values enable traversal and inclusion of arbitrary local files.

Attack Vector

Exploitation requires an authenticated session with Administrator-level access or higher. An attacker submits a crafted fm_locale value referencing an attacker-controlled or previously uploaded file located elsewhere on the WordPress server. When the vulnerable code path processes the request, the referenced file is included and executed within the plugin's PHP context. The vulnerability is exploitable over the network against any WordPress site running an unpatched Filester installation. Refer to the Wordfence vulnerability analysis for additional technical detail.

Detection Methods for CVE-2024-9669

Indicators of Compromise

Web server access log entries containing the fm_locale parameter with path traversal sequences such as ../ or absolute file paths
Recently uploaded files in wp-content/uploads/ that contain embedded PHP or JavaScript payloads inconsistent with their file type
Unexpected file-manager plugin requests originating from administrative accounts outside normal working hours
New or modified PHP files within the WordPress installation not tied to a documented plugin or theme update

Detection Strategies

Monitor requests to Filester endpoints and inspect the fm_locale parameter for traversal characters or references outside the plugin's language directory
Alert on administrator-authenticated requests that include local file paths in query or POST parameters
Correlate file upload events with subsequent inclusion requests referencing the uploaded filename
Deploy web application firewall rules that block path traversal patterns targeting WordPress plugin parameters

Monitoring Recommendations

Enable WordPress audit logging for administrator sessions, plugin activity, and file uploads
Baseline the contents of wp-content/plugins/filester/ and alert on unexpected file changes
Track PHP process behavior for unusual child processes or outbound connections following file-manager requests
Review authentication logs for administrator account compromise, including session tokens issued from unfamiliar IP addresses

How to Mitigate CVE-2024-9669

Immediate Actions Required

Update the Filester plugin to a version later than 1.8.5, as version 1.8.5 provides only a partial patch
Restrict Administrator accounts to the minimum required and enforce multi-factor authentication on all privileged WordPress users
Audit wp-content/uploads/ for suspicious files, especially images or archives containing script content
Disable or remove the plugin on sites where the file manager functionality is not required

Patch Information

The vulnerability was partially addressed in Filester 1.8.5. Vendor changesets are available at WordPress Changeset #3186518 and WordPress Changeset #3196150. Administrators should apply the latest available release from the WordPress plugin repository and verify that the fm_locale parameter is validated against an allowlist of supported locales in the deployed version.

Workarounds

Restrict access to /wp-admin/ using IP allowlists or a reverse proxy while a full patch is applied
Deploy a web application firewall rule that blocks path traversal sequences in the fm_locale parameter
Temporarily deactivate the Filester plugin if immediate patching is not possible
Reduce the number of accounts with Administrator, Editor, or equivalent privileges to shrink the exploitable user population

bash

# Example WAF rule (ModSecurity) blocking traversal in fm_locale
SecRule ARGS:fm_locale "@rx (\.\./|\.\.\\|/etc/|wp-content/uploads)" \
    "id:1009669,phase:2,deny,status:403,log,\
    msg:'CVE-2024-9669 Filester fm_locale path traversal attempt'"