CVE-2024-9935 Scanner

The PDF Generator Addon for Elementor Page Builder is a plugin widely used in WordPress environments for generating PDFs directly from web content. It is particularly popular among website developers and content creators who need automated PDF generation for their sites. This plugin integrates seamlessly with Elementor Page Builder, enhancing its functionality and efficiency in creating downloadable content.

The vulnerability detected allows an attacker to exploit path traversal within the plugin's rtw_pgaepb_dwnld_pdf() function. By manipulating the parameters of this function, attackers can access files outside the intended directories, exposing sensitive data. It is a significant security risk because unauthorized file access can lead to further exploitation of the system.

Technical details of the vulnerability involve the improper handling of input sanitization in the file download functionality. Attackers can inject directory traversal sequences like `../../../` to traverse file paths and access restricted files. The vulnerable endpoint is triggered using a crafted HTTP request that manipulates the "rtw_pdf_file" parameter.

Exploitation of this vulnerability can lead to unauthorized access to sensitive server files, including configuration files, database credentials, and other critical information. It compromises the server's integrity and may lead to further attacks or unauthorized access to user data.

REFERENCES

• https://github.com/RandomRobbieBF/CVE-2024-9935
• https://plugins.trac.wordpress.org/browser/pdf-generator-addon-for-elementor-page-builder/trunk/public/class-pdf-generator-addon-for-elementor-page-builder-public.php#L133
• https://www.wordfence.com/threat-intel/vulnerabilities/id/36daf2af-1db3-4b35-8849-480212660b2f?source=cve
• https://nvd.nist.gov/vuln/detail/CVE-2024-9935