Better Search Replace < 1.4.5 - PHP Object Injection

criticalseverity

9.8CVSS score

68%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Impact

Attackers can execute arbitrary code, delete files, or retrieve sensitive data on the server.

Fix

Update to the latest version of the plugin, version 1.4.5 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/better-search-replace/README.txt ; GET {{BaseURL}}/wp-content/plugins/better-search-replace/readme.txt
Positive when: status_code == 200 and contains(body, 'Better Search') and compare_versions(version, '< 1.4.5')

Run it with nuclei: nuclei -id CVE-2023-6933 -u <target>

The full check

id: CVE-2023-6933

info:
  name: Better Search Replace < 1.4.5 - PHP Object Injection
  author: pussycat0x
  severity: critical
  description: |
    The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
  impact: |
    Attackers can execute arbitrary code, delete files, or retrieve sensitive data on the server.
  remediation: Update to the latest version of the plugin, version 1.4.5 or later.
  reference:
    - https://posimyth.ticksy.com/ticket/2713734/
    - https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-6933
    cwe-id: CWE-502
    epss-score: 0.68047
    epss-percentile: 0.99331
    cpe: cpe:2.3:a:wpengine:better_search_replace:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    fofa-query: body="/wp-content/plugins/better-search-replace/"
    max-request: 1
    vendor: wpengine
    product: better_search_replace
    framework: wordpress
  tags: cve,cve2023,wordpress,wp-plugin,wp,wpscan,better-search-replace,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/better-search-replace/README.txt"
      - "{{BaseURL}}/wp-content/plugins/better-search-replace/readme.txt"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Better Search')"
          - "compare_versions(version, '< 1.4.5')"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from