CVE-2024-13617
📋 TL;DR
The aoa-downloadable WordPress plugin through version 0.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files from the server. This affects all WordPress sites running the vulnerable plugin version without proper file access controls.
💻 Affected Systems
- aoa-downloadable WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could download sensitive files like wp-config.php containing database credentials, server configuration files, or other sensitive data, leading to complete site compromise.
Likely Case
Attackers will download WordPress configuration files to obtain database credentials and potentially take over the website.
If Mitigated
With proper file permissions and web server restrictions, impact is limited to publicly accessible files only.
🎯 Exploit Status
Exploitation requires no authentication and minimal technical skill - attackers only need to craft a URL with a file path parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.1 or later
Vendor Advisory: https://wpscan.com/vulnerability/8d6dd979-21ef-4d14-9c42-bbd1d7b65c53/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'aoa-downloadable' plugin. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete the plugin immediately.
🔧 Temporary Workarounds
Disable vulnerable plugin
WordPressDeactivate and remove the aoa-downloadable plugin from WordPress
wp plugin deactivate aoa-downloadable
wp plugin delete aoa-downloadable
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests containing path traversal patterns
- Restrict file system permissions and implement proper directory traversal protections at web server level
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for aoa-downloadable plugin version 0.1.0 or earlierCheck Version:
wp plugin get aoa-downloadable --field=versionVerify Fix Applied:
Verify plugin version is 0.1.1 or later, or confirm plugin is completely removed from plugins directory📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /wp-content/plugins/aoa-downloadable/download.php with file path parameters
- Unusual file access patterns from single IP addresses
Network Indicators:
- Requests containing '../' patterns in URL parameters
- Multiple rapid requests to download.php endpoint
SIEM Query:
source="web_access_logs" AND uri_path="/wp-content/plugins/aoa-downloadable/download.php" AND (query="*../*" OR query="*..\\*" OR query="*file=*")