CVE-2023-5505

Executive Summary

CVE-2023-5505 is a directory traversal vulnerability in the BackWPup WordPress plugin, affecting versions up to and including 4.0.1. This flaw allows an authenticated attacker (with at least subscriber-level access) to manipulate the job-specific backup folder path, enabling backups to be written to arbitrary directories on the server. In a shared hosting environment, an attacker could set the backup destination to the root of another site, causing the plugin to place index.php and .htaccess files that disable directory listing and file access for that target site. The vulnerability is classified as Medium severity (CVSS 6.8) and currently has no known public exploit or patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
• Base Score: 6.8 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Changed (impact on other sites in shared environment)
• Confidentiality Impact: None
• Integrity Impact: High (ability to write files to arbitrary directories)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for cross-site disruption in shared hosting environments elevates the risk for WordPress multisite or shared server deployments.

Deep Dive & Mechanics

The vulnerability resides in the backup job configuration logic of the BackWPup plugin. When an authenticated user creates or edits a backup job, the plugin accepts a user-supplied path for the backup destination folder without proper validation or sanitization. The plugin then uses this path in filesystem operations to write backup archives and security files (index.php and .htaccess).

Attack Flow:

1. An attacker logs into WordPress with any account that can create or edit backup jobs (e.g., subscriber, author, editor).
2. The attacker creates a new backup job and sets the "Backup to Folder" option to a path outside the intended scope, such as ../../wp-content/uploads/another-site/ or /var/www/html/another-site/.
3. When the backup job runs (either manually or via cron), the plugin writes the backup archive and the security files (index.php and .htaccess) to the attacker-specified directory.
4. In a shared hosting environment, this can overwrite or place new security files in another site's root, effectively disabling directory listing and file access for that site.

Root Cause: The plugin fails to validate that the backup folder path is within the allowed WordPress uploads directory or a safe location. The path is used directly in filesystem calls without checking for directory traversal sequences (../).

Vulnerable vs. Patched Code

Vulnerable Code (BackWPup <= 4.0.1):

// In class-backwpup-job.php or similar
public function set_backup_folder($folder) {
    $this->backup_folder = $folder; // No sanitization
}

public function run_backup() {
    $folder = $this->backup_folder;
    if (!file_exists($folder)) {
        mkdir($folder, 0755, true);
    }
    // Write backup file
    file_put_contents($folder . '/backup.zip', $data);
    // Write security files
    file_put_contents($folder . '/index.php', '<?php // Silence is golden.');
    file_put_contents($folder . '/.htaccess', 'Deny from all');
}

Patched Code (Hypothetical Fix):

public function set_backup_folder($folder) {
    // Resolve and validate path
    $allowed_base = WP_CONTENT_DIR . '/uploads/backwpup/';
    $real_path = realpath($allowed_base . '/' . $folder);
    if (strpos($real_path, $allowed_base) !== 0) {
        throw new Exception('Invalid backup folder');
    }
    $this->backup_folder = $real_path;
}

Key Differences:

• The patched version uses realpath() to resolve directory traversal sequences.
• It checks that the resolved path starts with the allowed base directory.
• It rejects any path that attempts to escape the allowed scope.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with BackWPup plugin version <= 4.0.1
• Authenticated user account (subscriber or higher)
• Write permissions on target directory (server must allow PHP to write)

Exploitation Steps:

1. Log in to WordPress as an authenticated user.
2. Navigate to BackWPup > Jobs > Add New.
3. In the job configuration, set the Backup to Folder option to a traversal path, e.g., ../../wp-content/uploads/target-site/.
4. Configure the job to run immediately or schedule it.
5. Execute the backup job. The plugin will create the directory (if it doesn't exist) and write index.php and .htaccess files there.
6. Verify the attack: Access the target site's root directory via browser – directory listing should be disabled, and direct file access blocked.

Example Payload:

Backup Folder: ../../wp-content/uploads/victim-site/

Blue Team (Detection & Prevention)

Detection:

• Monitor for backup jobs with unusual folder paths containing ../ or absolute paths outside /wp-content/uploads/backwpup/.
• Alert on creation of index.php or .htaccess files in unexpected directories (e.g., outside the plugin's intended scope).
• Use file integrity monitoring (FIM) to detect unauthorized changes to .htaccess files.

Prevention:

• Apply the principle of least privilege: restrict which WordPress users can create or edit backup jobs.
• Use a Web Application Firewall (WAF) to block requests containing directory traversal patterns in backup folder parameters.
• Implement server-side path validation to ensure backup folders are within a safe, isolated directory.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected index.php or .htaccess files in directories outside the plugin's intended backup folder (e.g., /var/www/html/another-site/index.php).
  • Backup archives (.zip, .tar, .gz) in unusual locations.
• Logs:
  • WordPress audit logs showing backup jobs with folder paths containing ../ or absolute paths.
  • Server access logs showing requests to /wp-admin/admin.php?page=backwpupjobs&action=edit with suspicious folder parameters.
• Network:
  • Outbound connections from the server to attacker-controlled hosts (if backup archives are exfiltrated).

Detection Engineering

YARA Rule

rule CVE_2023_5505_BackWPup_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in BackWPup plugin"
        author = "Valters IT"
        date = "2025-04-08"
        cve = "CVE-2023-5505"
    strings:
        $traversal = /\.\.\/[^"]+/ 
        $backwpup_folder = "backup_folder" nocase
        $admin_page = "admin.php?page=backwpup" nocase
    condition:
        all of ($backwpup_folder, $admin_page) and $traversal
}

Sigma Rule

title: CVE-2023-5505 BackWPup Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit directory traversal in BackWPup plugin
author: Valters IT
date: 2025-04-08
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'page=backwpup'
            - 'action=edit'
            - 'folder=..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in backup configuration (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-5505 BackWPup Directory Traversal Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page=backwpup"; http_uri;
    content:"folder=.."; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2023-5505;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the BackWPup plugin until a patch is available.
2. Restrict user roles: Only allow trusted administrators to create or edit backup jobs.
3. Implement server-side path validation using a custom plugin or .htaccess rewrite rules to block directory traversal patterns.

Long-term Fix:

• The vendor should release a patched version that sanitizes the backup folder path using realpath() and restricts it to a safe base directory.
• Apply the principle of least privilege for WordPress user roles.

Workaround:

• Use a different backup plugin that properly validates paths (e.g., UpdraftPlus, Jetpack Backup).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert