Made I.T. Forms: Unauthenticated Remote Code Execution (CVE-2024-51791)

CVE-2024-51791 is an unauthenticated arbitrary file upload vulnerability found in the Made I.T. Forms WordPress plugin. The vulnerability allows an unauthenticated attacker to upload arbitrary PHP files to the server, facilitating remote code execution. A proof-of-concept (PoC) exploit script is publicly available, which automates the process of identifying vulnerable endpoints, uploading a PHP payload, and establishing an interactive shell.

Attack Chain

1. Attacker identifies a WordPress site running the vulnerable Made I.T. Forms plugin.
2. Attacker interacts with a vulnerable form endpoint (e.g., /form-1/).
3. Attacker submits a maliciously crafted request body containing a PHP payload and the form-id parameter.
4. The vulnerable plugin fails to sanitize the file upload, saving the PHP shell to the web-accessible directory.
5. Attacker enumerates the upload directories to locate the deployed web shell.
6. Attacker triggers the web shell to execute OS commands or establish a reverse shell.

Impact

Successful exploitation allows for full compromise of the underlying web server, including unauthorized access to sensitive data, modification of site content, and potential lateral movement within the network.

Recommendation

• Identify all WordPress instances running the Made I.T. Forms plugin.
• Implement strict ingress filtering to prevent unauthenticated access to form endpoints if immediate patching is not possible.
• Monitor web server logs for suspicious POST requests to form endpoints containing PHP code or unusual filename extensions.
• Ensure security patches for the Made I.T. Forms plugin are applied as soon as they are made available by the vendor.