CVE-2025-2105

Executive Summary

CVE-2025-2105 is a critical PHP Object Injection vulnerability affecting the Jupiter X Core plugin for WordPress, up to and including version 4.8.11. The flaw resides in the raven_download_file function, which deserializes untrusted input from the file parameter without proper sanitization. This allows an attacker to inject a malicious PHP object via a PHAR file. While no known POP chain exists within the vulnerable plugin itself, the presence of any other plugin or theme containing a POP chain on the same WordPress site can lead to severe consequences, including arbitrary file deletion, sensitive data exfiltration, or remote code execution. The vulnerability is exploitable by unauthenticated attackers if a form with a file download action and file upload capability is present; otherwise, it requires Contributor-level access or higher to create the necessary form. The CVSS score is 8.1 (High), and no public exploit code or patch is currently available.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress ecosystem, targeting the Jupiter X Core plugin. It does not affect Apache or Nginx directly. The attack vector relies on WordPress’s file handling and form functionality, making it a WordPress-specific threat.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (unauthenticated) or Contributor (depending on form presence)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication in certain configurations. The potential for RCE via a POP chain elevates the risk significantly.

Deep Dive & Mechanics

The vulnerability is a classic PHP Object Injection (CWE-502) arising from insecure deserialization. The raven_download_file function in Jupiter X Core processes the file parameter by passing it to PHP’s unserialize() or a similar deserialization function. When an attacker uploads a crafted PHAR file (which contains serialized PHP objects) and then triggers the download function with the path to that PHAR file, the deserialization occurs. This allows the attacker to instantiate arbitrary PHP objects.

The key mechanics:

1. PHAR Deserialization: PHP’s PHAR file format automatically deserializes metadata when the file is accessed via phar:// wrapper. The file parameter is used to construct a path that may be passed to file_get_contents() or similar, which triggers the PHAR deserialization.
2. POP Chain Dependency: The vulnerability itself does not include a POP chain (a set of magic methods like __destruct, __wakeup, __toString that can be chained to execute code). However, if any other installed plugin or theme contains a suitable POP chain, the attacker can leverage it to perform arbitrary actions.
3. Exploitation Path: An unauthenticated attacker can exploit this if the site has a form with a file download action and file upload capability. Otherwise, a Contributor-level user can create such a form. The attacker uploads a malicious PHAR file via the form, then triggers the download function with the PHAR path, leading to deserialization.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern. The vulnerable function likely looks like:

// Vulnerable code in Jupiter X Core <= 4.8.11
function raven_download_file() {
    $file = $_GET['file']; // or $_POST
    // No sanitization or validation
    $content = file_get_contents($file); // PHAR deserialization occurs here
    // ... rest of download logic
}

A patched version would need to:

• Validate the file parameter against a whitelist of allowed paths.
• Use realpath() to resolve the path and ensure it points to an expected directory.
• Avoid using file_get_contents() with user-supplied paths that could be a PHAR URL.
• Implement proper input sanitization and avoid deserialization of untrusted data.

Example patched code:

// Patched code (hypothetical)
function raven_download_file() {
    $file = $_GET['file'];
    $allowed_dir = WP_CONTENT_DIR . '/uploads/';
    $real_path = realpath($file);
    if (strpos($real_path, $allowed_dir) !== 0) {
        wp_die('Invalid file path.');
    }
    // Use a safe method to read file content
    $content = file_get_contents($real_path);
    // ... rest of download logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Jupiter X Core <= 4.8.11.
• A form with file upload and file download actions (or Contributor access to create one).
• A POP chain in another plugin/theme (e.g., a plugin with a __destruct method that deletes files).

Exploitation Steps:

1. Craft a malicious PHAR file containing a serialized object that triggers the POP chain. For example, if a POP chain exists that deletes arbitrary files, the serialized object would target a specific file.
2. Upload the PHAR file via the form’s file upload functionality.
3. Trigger the download by sending a request to the raven_download_file endpoint with the file parameter set to phar://./wp-content/uploads/2025/01/malicious.phar.
4. Observe the impact (e.g., file deletion, data exfiltration).

Example request:

GET /wp-admin/admin-ajax.php?action=raven_download_file&file=phar://./wp-content/uploads/2025/01/exploit.phar HTTP/1.1
Host: target-site.com

Blue Team

Detection:

• Monitor for requests to admin-ajax.php with action=raven_download_file and a file parameter containing phar://.
• Look for unusual file uploads with .phar extension or files with PHAR magic bytes (50 48 41 52).
• Alert on deserialization-related errors in PHP logs.

Hunting:

• Search for any PHAR files in the uploads directory.
• Review form submissions for file uploads that are not typical images or documents.
• Check for Contributor-level users creating forms with file download actions.

Lab Setup:

1. Install a local WordPress instance with Jupiter X Core 4.8.11.
2. Install a plugin with a known POP chain (e.g., a plugin with __destruct that deletes files).
3. Create a form with file upload and download actions.
4. Upload a test PHAR file and trigger the vulnerability to observe behavior.

Indicators of Compromise (IOCs)

• File Artifacts:
  • PHAR files in wp-content/uploads/ with suspicious names (e.g., exploit.phar, payload.phar).
  • Unexpected files in wp-content/uploads/ with .phar extension.
• Network Indicators:
  • HTTP requests to /wp-admin/admin-ajax.php with action=raven_download_file and file=phar://....
  • Outbound connections from the server to unknown IPs (if RCE is achieved).
• Log Indicators:
  • PHP error logs containing unserialize() errors or PHAR-related warnings.
  • Web server logs showing phar:// in the query string.
• System Indicators:
  • Unexpected file deletions or modifications.
  • New user accounts or processes (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_2105_PHAR_Upload {
    meta:
        description = "Detects PHAR files uploaded to WordPress that may exploit CVE-2025-2105"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-2105"
    strings:
        $phar_magic = { 50 48 41 52 } // PHAR magic bytes
        $serialized = /O:\d+:"[^"]+":\d+:/ // Serialized object pattern
    condition:
        $phar_magic at 0 and $serialized
}

Sigma Rule

title: CVE-2025-2105 Jupiter X Core PHAR Deserialization
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit PHP Object Injection via PHAR file in Jupiter X Core
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=raven_download_file'
        cs-uri-query|contains: 'file=phar://'
    condition: selection
falsepositives:
    - Legitimate use of PHAR files (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2105 Jupiter X Core PHAR Deserialization Attempt"; flow:to_server; content:"GET"; http_method; content:"admin-ajax.php"; http_uri; content:"action=raven_download_file"; http_uri; content:"file=phar://"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Jupiter X Core plugin until a patch is available.
2. Remove any forms that use the file download action.
3. Restrict file uploads to only trusted file types (e.g., images, PDFs) and disable PHAR uploads via .htaccess or server configuration.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Implement input validation and sanitization for all file-related parameters.
• Use a Web Application Firewall (WAF) to block requests containing phar:// in query strings.
• Regularly update all WordPress plugins and themes.

Workaround:

• Add the following to .htaccess to block PHAR file access:

  <FilesMatch "\.phar$">
      Order allow,deny
      Deny from all
  </FilesMatch>
  

• Disable the phar stream wrapper in php.ini if not needed:

  ; Disable PHAR stream wrapper
  allow_url_fopen = Off
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert