CVE-2024-5630·PHP vulnerability

Affected versions

How to fix this CVE

Update the Insert or Embed Articulate Content plugin to version 4.3000000024 or later to prevent unauthorized file uploads by authenticated users. This vulnerability allows authors with upload permissions to bypass file type validation and deploy malicious PHP files, potentially leading to remote code execution. Apply the update immediately, especially on public-facing WordPress installations where multiple user accounts exist.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST /wp-admin/upload.php with Content-Disposition header containing .php extension or PHP MIME type in multipart form data, originating from authenticated user session

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Implement WAF rules to restrict file uploads with PHP extensions (.php, .php3, .php4, .php5, .phtml, .pht) in the wp-content/uploads/ directory and log all upload attempts for suspicious file types. Block or challenge requests where Content-Type claims one type (e.g., image/jpeg) but filename contains executable extensions.

How to check if you are affected

1. Step 1: Check the installed version of the Articulate plugin by logging into WordPress admin, navigating to Plugins, and locating 'Insert or Embed Articulate Content' — compare the listed version against 4.3000000024
2. Step 2: Query the WordPress database with: `mysql -u wordpress_user -p wordpress_db -e "SELECT option_value FROM wp_options WHERE option_name='active_plugins';"` to confirm the plugin is active
3. Step 3: Search web server logs for suspicious file uploads to wp-content/uploads/ directory: `grep -r '\.php' /var/www/html/wp-content/uploads/ | grep -v '\.php\.' | head -20`
4. Step 4: Verify the plugin update by checking the plugin version again in WordPress admin or via database: `mysql -u wordpress_user -p wordpress_db -e "SELECT meta_value FROM wp_options WHERE option_name LIKE '%articulate%';"` after applying the patch

Indicators of compromise

• POST requests to /wp-admin/upload.php with .php file extensions
• Suspicious PHP files in wp-content/uploads/ directory with creation timestamps correlating to authentication logs
• HTTP 200 responses following multipart file uploads with executable extensions

FAQ

Related PHP CVEs

References

• https://wpscan.com/vulnerability/538c875f-4c20-4be0-8098-5bddb7aecff4/
• https://wpscan.com/vulnerability/538c875f-4c20-4be0-8098-5bddb7aecff4/