CVE-2021-24347 – This vulnerability allows authenticated users t... (How to Fix)

Q: What is the severity of CVE-2021-24347?

CVE-2021-24347 has a CVSS score of 8.8 (HIGH). This vulnerability allows authenticated users to upload malicious PHP files by changing the file extension case (e.g., 'php' to 'pHP'), bypassing the plugin's file type validation. It affects WordPress sites running the SP Project & Document Manager plugin, potentially leading to remote code execution. Attackers could gain full control of affected websites.

📋 TL;DR

This vulnerability allows authenticated users to upload malicious PHP files by changing the file extension case (e.g., 'php' to 'pHP'), bypassing the plugin's file type validation. It affects WordPress sites running the SP Project & Document Manager plugin, potentially leading to remote code execution. Attackers could gain full control of affected websites.

💻 Affected Systems

Products:

WordPress SP Project & Document Manager plugin

Versions: All versions before 4.22

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated user access to upload files. Default WordPress configurations with this plugin are vulnerable.

📦 What is this software?

Sp Project \& Document Manager by Smartypantsplugins

View all CVEs affecting Sp Project \& Document Manager →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise via remote code execution, allowing attackers to install backdoors, steal data, deface websites, or pivot to internal networks.

🟠

Likely Case

Website takeover through webshell upload, leading to data theft, malware distribution, or use as part of a botnet.

🟢

If Mitigated

Limited impact with proper file upload restrictions, web application firewalls, and server hardening in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires authenticated user access. Multiple public exploit scripts and detailed write-ups are available.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 4.22 and later

Vendor Advisory: https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'SP Project & Document Manager'. 4. Click 'Update Now' if available. 5. Alternatively, download version 4.22+ from WordPress repository and manually update.

🔧 Temporary Workarounds

Disable plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate sp-client-document-manager

Restrict file uploads

linux

Block PHP file uploads at web server level

# In Apache .htaccess: <FilesMatch "\.(?i:php|php3|php4|php5|phtml|phps)$">
  Order Deny,Allow
  Deny from all
</FilesMatch>
# In Nginx: location ~* \.(php|php3|php4|php5|phtml|phps)$ {
  deny all;
}

🧯 If You Can't Patch

Remove plugin completely from production systems
Implement strict file upload validation at application layer

🔍 How to Verify

Check if Vulnerable:

Check plugin version in WordPress admin panel under Plugins > Installed Plugins. If version is below 4.22, system is vulnerable.

Check Version:

wp plugin get sp-client-document-manager --field=version

Verify Fix Applied:

Confirm plugin version is 4.22 or higher. Test file upload functionality with case-varied PHP extensions.

📡 Detection & Monitoring

Log Indicators:

File uploads with case-varied PHP extensions (pHP, PhP, etc.)
Unauthorized file writes to upload directories
Webshell access patterns in access logs

Network Indicators:

POST requests to upload endpoints with PHP files
Unusual outbound connections from web server

SIEM Query:

source="web_logs" AND (uri_path="*/wp-content/plugins/sp-client-document-manager/*" AND method="POST") AND (file_extension="*[Pp][Hh][Pp]" OR user_agent="*curl*" OR user_agent="*wget*")

📊 Metadata

CVE ID: CVE-2021-24347

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-178

Published: June 14, 2021

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a Exploit,Third Party Advisory
http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html Exploit,Third Party Advisory,VDB Entry
https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-24347, you might also want to check these: