JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - 認証されていないPHPコードインジェクションによるリモートコード実行
プラットフォーム
wordpress
コンポーネント
js-support-ticket
修正版
2.8.7
CVE-2024-7094 is a critical Remote Code Execution (RCE) vulnerability discovered in the JS Help Desk – The Ultimate Help Desk & Support Plugin for WordPress. This flaw allows unauthenticated attackers to execute arbitrary code on the server due to insufficient input sanitization within the 'storeTheme' function. Versions of the plugin up to and including 2.8.6 are affected, and a full fix is available in version 2.8.7.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
The impact of CVE-2024-7094 is severe. Successful exploitation allows an attacker to execute arbitrary PHP code on the web server hosting the WordPress site. This can lead to complete server compromise, including data theft, modification, or deletion. Attackers could also leverage this access to install malware, create backdoors for persistent access, or launch further attacks against other systems on the network. The lack of authentication requirements significantly broadens the attack surface, making it accessible to a wide range of malicious actors.
悪用の状況翻訳中…
CVE-2024-7094 was publicly disclosed on August 13, 2024. While no active exploitation campaigns have been definitively confirmed, the CRITICAL severity and ease of exploitation suggest a high likelihood of exploitation attempts. Public proof-of-concept code is likely to emerge, further increasing the risk. This vulnerability is not currently listed on the CISA KEV catalog.
リスク対象者翻訳中…
WordPress websites using the JS Help Desk plugin, particularly those running versions prior to 2.8.7, are at significant risk. Shared hosting environments are especially vulnerable, as a compromise of one site can potentially impact others on the same server. Sites with weak WordPress security configurations or those lacking regular plugin updates are also at increased risk.
検出手順翻訳中…
• wordpress / composer / npm:
grep -r 'storeTheme' /var/www/html/wp-content/plugins/js-help-desk/• wordpress / composer / npm:
wp plugin list --status=all | grep 'JS Help Desk'• wordpress / composer / npm:
wp plugin update js-help-desk• generic web: Check WordPress plugin directory for updates and security advisories related to JS Help Desk.
攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
71.96% (99% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- 高 — 任意のデータの書き込み・変更・削除が可能。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
パッケージ情報
- アクティブインストール数
- 8K既知
- プラグイン評価
- 3.8
- WordPressが必要
- 5.5+
- 動作確認済みバージョン
- 6.9.4
- PHPが必要
- 7.4+
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2024-7094 is to immediately upgrade the JS Help Desk plugin to version 2.8.7 or later. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting access to the 'storeTheme' function. This could involve modifying the plugin's code (with caution and thorough testing) or using a WordPress security plugin to block access to the vulnerable endpoint. Monitor WordPress access logs for suspicious activity related to the 'storeTheme' function. After upgrading, confirm the fix by attempting to trigger the vulnerability via a controlled test – ensure no code execution occurs.
修正方法
JS Help Desk – The Ultimate Help Desk & Support Pluginプラグインをバージョン2.8.7以降にアップデートしてください。このバージョンは、リモートコード実行を可能にするPHPコードインジェクションの脆弱性を修正しています。
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2024-7094 — RCE in JS Help Desk WordPress Plugin?
CVE-2024-7094 is a critical Remote Code Execution vulnerability in the JS Help Desk WordPress plugin, allowing attackers to execute code on the server if you're using versions up to 2.8.6.
Am I affected by CVE-2024-7094 in JS Help Desk WordPress Plugin?
Yes, if you are using the JS Help Desk plugin version 2.8.6 or earlier, you are vulnerable to this RCE vulnerability. Upgrade immediately.
How do I fix CVE-2024-7094 in JS Help Desk WordPress Plugin?
Upgrade the JS Help Desk plugin to version 2.8.7 or later to resolve this vulnerability. If immediate upgrade isn't possible, consider temporary workarounds like restricting access to the 'storeTheme' function.
Is CVE-2024-7094 being actively exploited?
While no confirmed active exploitation campaigns have been reported, the CRITICAL severity and ease of exploitation suggest a high likelihood of exploitation attempts.
Where can I find the official JS Help Desk advisory for CVE-2024-7094?
Refer to the JS Help Desk plugin's official website and WordPress plugin repository for the latest security advisory and update information.