CVE-2024-8507

Cross-Site Request Forgery (CSRF) (CWE-352)

Published: Oct 16, 2024 / Updated: 34d ago

010
CVSS 8.8EPSS 0.06%High
CVE info copied to clipboard

Summary

The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 8.3.9. This vulnerability is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. As a result, unauthenticated attackers can potentially upload arbitrary files via a forged request if they can trick a site administrator into performing an action such as clicking on a link.

Impact

The impact of this vulnerability is severe, with a CVSS v3.1 base score of 8.8 (High). If exploited successfully, an attacker could achieve high levels of impact on confidentiality, integrity, and availability of the affected system. The attack vector is network-based, with low attack complexity and no privileges required. However, user interaction is required for the attack to succeed. Potential impacts include: 1. Unauthorized file uploads: Attackers could upload malicious files to the WordPress installation. 2. Remote code execution: If combined with other vulnerabilities, this could lead to executing arbitrary code on the server. 3. Website defacement: Uploading of unwanted content could alter the appearance and functionality of the website. 4. Data theft: Sensitive information could be exposed if attackers manage to upload and execute malicious scripts. 5. Further system compromise: The uploaded files could serve as a foothold for more extensive attacks on the server or network.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is not explicitly mentioned in the provided vulnerability data. However, given that the vulnerability affects "all versions up to, and including, 8.3.9" of the File Manager Pro plugin, it is likely that a patched version newer than 8.3.9 is available or will be released soon. The security team should check for updates to the File Manager Pro plugin and apply them as soon as they become available.

Mitigation

1. Update the File Manager Pro plugin: As soon as a patched version becomes available, update to the latest version of the plugin. 2. Implement proper CSRF protection: Ensure that all WordPress plugins, especially File Manager Pro, use proper nonce validation for all actions, particularly for the 'mk_file_folder_manager' ajax action. 3. Limit plugin usage: If possible, disable or remove the File Manager Pro plugin until a patch is available, especially on production sites. 4. User awareness training: Educate administrators and users about the risks of clicking on unknown links, especially when logged into the WordPress admin panel. 5. Implement Web Application Firewall (WAF): Use a WAF that can detect and block CSRF attempts. 6. Regular security audits: Conduct regular security audits of your WordPress installation, focusing on plugin vulnerabilities. 7. Principle of least privilege: Ensure that user accounts have only the necessary permissions to perform their required tasks. 8. Monitor for suspicious activities: Implement logging and monitoring for unusual file uploads or changes to the website.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-8507

Oct 16, 2024 at 7:15 AM
First Article

Feedly found the first article mentioning CVE-2024-8507. See article

Oct 16, 2024 at 7:24 AM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 16, 2024 at 7:24 AM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 16, 2024 at 7:36 AM
EPSS

EPSS Score was set to: 0.06% (Percentile: 25%)

Oct 17, 2024 at 10:04 AM
Static CVE Timeline Graph

Affected Systems

Filemanagerpro/file_manager
+null more

Attack Patterns

CAPEC-111: JSON Hijacking (aka JavaScript Hijacking)
+null more

News

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 14, 2024 to October 20, 2024)
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WordPress Plugins with Reported Vulnerabilities Last Week
Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.–Social Link Groups Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com acm309–PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
US-CERT Vulnerability Summary for the Week of October 14, 2024
Primary Vendor — Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.–Social Link Groups Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 [email protected] acm309–PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.--Social Link Groups Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com acm309--PutongOJ PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually.
null
- HIGH - CVE-2024-8507 The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI