CVE-2024-7627: bitapps file_manager Race Condition

Vulnerability summary

CVE-2024-7627 is a high (CVSS 8.1) Race Condition vulnerability in bitapps file_manager. EPSS estimates a 2.80% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities.

Timeline

1. 05-09-2024
   PublishedVulnerability first disclosed.
2. 05-09-2024
   Last modifiedVulnerability information updated.

Description

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.