Plattform
wordpress
Komponente
social-web-suite
Behoben in
4.1.12
CVE-2024-8352 is a directory traversal vulnerability affecting the Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress. This vulnerability allows unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability impacts versions up to and including 4.1.11. A fix is available in a later version of the plugin.
The directory traversal vulnerability in Social Web Suite allows an attacker to bypass intended access controls and read files outside of the plugin's designated directory. By manipulating the download_log function, an attacker can craft requests to access files anywhere on the server's file system that the webserver process has access to. This could include configuration files, database credentials, or even source code, leading to a significant compromise of the WordPress site. The potential impact extends beyond data exposure; an attacker could potentially modify files or execute arbitrary code if the webserver process has write access to certain directories.
CVE-2024-8352 was publicly disclosed on 2024-10-03. There is currently no indication of active exploitation campaigns targeting this vulnerability. The vulnerability is not listed on the CISA KEV catalog at the time of this writing. Public proof-of-concept exploits are available, increasing the risk of exploitation if the vulnerability remains unpatched.
WordPress websites utilizing the Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin, particularly those running versions prior to the patched release, are at risk. Shared hosting environments are especially vulnerable as they often have limited access controls and a higher density of potential targets.
• wordpress / composer / npm:
grep -r "download_log function" /var/www/html/wp-content/plugins/social-web-suite-social-media-auto-post-social-media-auto-publish/• generic web:
curl -I 'http://your-wordpress-site.com/wp-content/plugins/social-web-suite-social-media-auto-post-social-media-auto-publish/../../../../etc/passwd' # Attempt to access sensitive filesdisclosure
Exploit-Status
EPSS
3.42% (87% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2024-8352 is to upgrade the Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin to a version that includes the fix. If upgrading is not immediately possible, implement a Web Application Firewall (WAF) rule to block requests containing suspicious characters or paths in the downloadlog parameter. Carefully review file permissions on the server to ensure the webserver process has minimal access to sensitive files. Consider using a WordPress security plugin with directory traversal protection features. After upgrade, verify the fix by attempting to access a file outside the plugin's designated directory via the downloadlog function; access should be denied.
Actualice el plugin Social Web Suite – Social Media Auto Post, Social Media Auto Publish a la última versión disponible. La versión corregida incluye una solución para la vulnerabilidad de recorrido de directorios que permite la descarga de archivos arbitrarios.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2024-8352 is a directory traversal vulnerability affecting the Social Web Suite plugin for WordPress, allowing attackers to read arbitrary files on the server.
You are affected if you are using Social Web Suite versions 4.1.11 or earlier. Check your plugin version and upgrade immediately.
Upgrade to the latest version of the Social Web Suite plugin. If immediate upgrade is not possible, implement WAF rules to block path traversal attempts.
Currently, there are no confirmed reports of active exploitation, but the ease of exploitation suggests potential future targeting.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.