CVE-2024-13537
📋 TL;DR
The C9 Blocks WordPress plugin contains a publicly accessible file (composer-setup.php) that discloses the full server path when accessed. This affects all WordPress sites using C9 Blocks version 1.7.7 or earlier. While the path disclosure alone doesn't cause direct damage, it can help attackers plan further attacks if other vulnerabilities exist.
💻 Affected Systems
- C9 Blocks WordPress Plugin
📦 What is this software?
C9 Blocks by Covertnine
⚠️ Risk & Real-World Impact
Worst Case
Attackers combine path disclosure with other vulnerabilities (like file inclusion or directory traversal) to execute arbitrary code, read sensitive files, or compromise the WordPress installation.
Likely Case
Attackers gather reconnaissance information about server structure to aid in targeted attacks, increasing success probability for subsequent exploitation attempts.
If Mitigated
Path disclosure provides limited value without additional vulnerabilities, causing minimal impact with proper security controls and monitoring.
🎯 Exploit Status
Exploitation requires simple HTTP GET request to vulnerable file path. Often used in reconnaissance phases of attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.8 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/c9-blocks/trunk/composer-setup.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find C9 Blocks plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress plugin repository and manually update.
🔧 Temporary Workarounds
Remove vulnerable file
linuxDelete or restrict access to composer-setup.php file
rm /path/to/wordpress/wp-content/plugins/c9-blocks/composer-setup.php
Block access via .htaccess
linuxPrevent public access to composer-setup.php using Apache rewrite rules
<Files "composer-setup.php">
Order Allow,Deny
Deny from all
</Files>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to composer-setup.php
- Monitor and alert on access attempts to composer-setup.php file
🔍 How to Verify
Check if Vulnerable:
Access https://yoursite.com/wp-content/plugins/c9-blocks/composer-setup.php - if it returns server path information, you're vulnerable.Check Version:
Check WordPress admin panel under Plugins > Installed Plugins for C9 Blocks versionVerify Fix Applied:
After update, attempt to access the same URL - should return 404 error or blank page instead of path disclosure.📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /wp-content/plugins/c9-blocks/composer-setup.php
- 404 errors for composer-setup.php after patching
Network Indicators:
- Unusual scanning patterns targeting plugin directories
- Repeated requests to composer-setup.php from single IP
SIEM Query:
source="web_logs" AND uri="/wp-content/plugins/c9-blocks/composer-setup.php"