CVE-2024-9935 Scanner

CVE-2024-9935 Scanner - Arbitrary File Download vulnerability in PDF Generator Addon for Elementor Page Builder

Short Info


Level

High

Single Scan

Single Scan

Can be used by

Asset Owner

Estimated Time

10 seconds

Time Interval

9 days 1 hour

Scan only one

Domain, IPv4

Toolbox

-

The PDF Generator Addon for Elementor Page Builder is a plugin widely used in WordPress environments for generating PDFs directly from web content. It is particularly popular among website developers and content creators who need automated PDF generation for their sites. This plugin integrates seamlessly with Elementor Page Builder, enhancing its functionality and efficiency in creating downloadable content.

The vulnerability detected allows an attacker to exploit path traversal within the plugin's rtw_pgaepb_dwnld_pdf() function. By manipulating the parameters of this function, attackers can access files outside the intended directories, exposing sensitive data. It is a significant security risk because unauthorized file access can lead to further exploitation of the system.

Technical details of the vulnerability involve the improper handling of input sanitization in the file download functionality. Attackers can inject directory traversal sequences like `../../../` to traverse file paths and access restricted files. The vulnerable endpoint is triggered using a crafted HTTP request that manipulates the "rtw_pdf_file" parameter.

Exploitation of this vulnerability can lead to unauthorized access to sensitive server files, including configuration files, database credentials, and other critical information. It compromises the server's integrity and may lead to further attacks or unauthorized access to user data.

REFERENCES

Get started to protecting your Free Full Security Scan