W3 Total Cache < 2.8.2 - Log File Exposure

id: CVE-2024-12008

info:
  name: W3 Total Cache < 2.8.2 - Log File Exposure
  author: ritikchaddha
  severity: medium
  description: |
    The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF attacks.
  impact: |
    Unauthenticated attackers can extract sensitive credentials, leading to potential account compromise and further attacks.
  remediation: |
    Update the W3 Total Cache plugin to version 2.8.2 or later, which restricts access to debug log files. Additionally, disable debug logging in production environments and ensure .htaccess rules block direct access to the cache/log directory.
  reference:
    - https://wpscan.com/vulnerability/1685ca58-1622-433b-b561-304cb9d1bc56/
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/8292f23c-fb17-4082-9788-f643d1bb097e
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12008
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-12008
    epss-score: 0.02169
    epss-percentile: 0.80072
    cwe-id: CWE-532
  metadata:
    verified: true
    max-request: 3
    vendor: boldgrid
    product: w3-total-cache
    framework: wordpress
    shodan-query: http.component:"WordPress" http.component:"W3 Total Cache"
    fofa-query: app="WordPress-W3-Total-Cache"
  tags: cve,cve2024,wordpress,wp,wp-plugin,w3-total-cache,exposure,logs

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/cache/log/000000/pagecache.log"
      - "{{BaseURL}}/wp-content/cache/log/000000/minify.log"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'regex("\\[[A-Za-z]{3}, \\d{2} [A-Za-z]{3} \\d{4} \\d{2}:\\d{2}:\\d{2} [+-]\\d{4}\\]", body)'
          - 'contains(body, "[/] [-]")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100d4e8b8d7161be4a0b01123eb3bbf37dc8dbeaa081002a7ae3c839e3dba05ad3f02210097154e1323dd979a74097f01554a049ee8afdb5a43598c95cc35b20a35b084ef:922c64590222798bb761d5b6d8e72950