PT-2024-38887 · WordPress · Mstore Api

Matthew Rollings + 1 · Published 2024-09-13 · Updated 2024-09-18 · CVE-2024-8242

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress versions up to, and including, 4.15.3

Description: The issue arises from missing file type validation in the update user profile() function, allowing authenticated attackers with subscriber-level access and above to upload arbitrary files (excluding PHP files) to the site's server. This could potentially lead to remote code execution. The vulnerability can be exploited by unauthenticated users if paired with a registration endpoint.

Recommendations: For versions up to, and including, 4.15.3, update to a version that includes a fix for the missing file type validation in the update user profile() function to prevent arbitrary file uploads. As a temporary workaround, consider disabling the update user profile() function until a patch is available.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-8242

Affected Products

Mstore Api

References · 9

• https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/functions/index.php · Patch
• https://osv.dev/vulnerability/CVE-2024-8242 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8242 · Security Note
• https://plugins.trac.wordpress.org/changeset/3147900/mstore-api/trunk/controllers/flutter-user.php · Patch
• https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L1053 · Note
• https://t.me/cvedetector/5612 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fe3834a6-a6f5-4cc7-951e-a6ada6346b07?source=cve · Note
• https://twitter.com/CVEnew/status/1834616412469363051 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1834638043992522889 · Twitter Post