Webfulcreations Computer Repair Shop: Unauthenticated remote code execution (CVE-2024-51793)

CVE-2024-51793 is an unauthenticated arbitrary file upload vulnerability in the Webfulcreations Computer Repair Shop WordPress plugin (versions 3.8115 and below). The flaw resides in the handling of requests to admin-ajax.php, which can be leveraged to upload arbitrary PHP files without authentication. Once uploaded, these files can be executed, leading to full system compromise. Proof-of-concept exploit code is publicly available.

Attack Chain

1. Attacker identifies a target running a vulnerable version of the Computer Repair Shop plugin.
2. Attacker sends an unauthenticated POST request to the admin-ajax.php endpoint.
3. The request exploits the vulnerability to bypass file type validation.
4. A malicious PHP payload is uploaded to the web server directory.
5. The server response provides the direct URL to the newly uploaded file.
6. Attacker accesses the PHP file via a browser to execute code and obtain an interactive shell.

Impact

Successful exploitation allows for unauthenticated remote code execution with the privileges of the web server process. This results in complete compromise of confidentiality, integrity, and availability (CVSS 10.0).

Recommendation

• Update Webfulcreations Computer Repair Shop to a version beyond 3.8115 immediately.
• Implement monitoring for unexpected file creation within the WordPress wp-content/uploads directory or other web-accessible paths.
• Inspect web server access logs for anomalous POST requests directed at admin-ajax.php containing file upload parameters.
• If patching is not immediately feasible, restrict access to admin-ajax.php for unauthorized users via firewall or web application firewall (WAF) rules.