CVE-2025-3703

Executive Summary

CVE-2025-3703 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the CSS & JavaScript Toolbox WordPress plugin by Wipeoutmedia. The flaw resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, configuration files, or source code. The vulnerability affects all versions prior to 12.0.3. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is elevated due to the plugin's widespread use in WordPress environments.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory. Users are advised to verify the integrity of their plugin files and ensure they are sourced from the official repository. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for WordPress sites using the affected plugin.

Deep Dive & Mechanics

The vulnerability originates from the plugin's handling of file inclusion operations. The plugin likely uses a user-controllable parameter (e.g., file, template, or view) in a PHP include() or require() statement without proper sanitization or validation. An attacker can manipulate this parameter to traverse directories and include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename input, allowing path traversal sequences like ../../ to escape the intended directory. This is a classic example of CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint, typically found in the plugin's AJAX handlers or shortcode processing. The request includes a malicious file parameter pointing to a sensitive file on the server.

Impact: Successful exploitation allows the attacker to read sensitive files, including:

• WordPress configuration files (wp-config.php)
• Server configuration files (/etc/passwd, /etc/shadow)
• Application source code
• Log files containing credentials or session tokens

Vulnerable vs. Patched Code

Vulnerable Code (Pre-12.0.3):

<?php
// Vulnerable: Direct use of user input in include
$file = $_GET['file'];
include($file);
?>

Patched Code (12.0.3+):

<?php
// Patched: Whitelist allowed files and sanitize input
$allowed_files = array('template1.php', 'template2.php');
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include($file);
} else {
    // Handle error
}
?>

The patched version implements a whitelist approach and uses basename() to strip directory traversal sequences, effectively mitigating the LFI vulnerability.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with CSS & JavaScript Toolbox plugin version 12.0.2.
2. Ensure the plugin is activated and accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=cssjs_toolbox&file=).
2. Craft a request to read /etc/passwd:

   GET /wp-admin/admin-ajax.php?action=cssjs_toolbox&file=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the response will contain the contents of /etc/passwd.

Example cURL Command:

curl -v "http://target.com/wp-admin/admin-ajax.php?action=cssjs_toolbox&file=../../../../../../etc/passwd"

Blue Team (Defensive)

Detection:

• Monitor for suspicious file parameters containing ../ sequences.
• Alert on requests to plugin AJAX endpoints with unusual file paths.
• Use WAF rules to block path traversal patterns.

Mitigation:

• Immediately update the plugin to version 12.0.3 or later.
• If immediate update is not possible, disable the plugin temporarily.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing file=../../ or similar path traversal patterns.
  • Requests to /wp-admin/admin-ajax.php with action=cssjs_toolbox and suspicious file parameters.
• File System IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, or wp-config.php via web logs.
• Log IOCs:
  • Web server logs showing 200 responses to LFI attempts.
  • PHP error logs indicating failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2025_3703_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting CSS & JavaScript Toolbox plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3703"
    strings:
        $lfi_pattern = /file=\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\// nocase
        $plugin_path = /css-javascript-toolbox/ nocase
    condition:
        $lfi_pattern and $plugin_path
}

Sigma Rule

title: CVE-2025-3703 LFI Attempt Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in CSS & JavaScript Toolbox plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'file=../'
            - 'file=..%2f'
            - 'file=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-3703 LFI Attempt - CSS & JavaScript Toolbox"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=cssjs_toolbox"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the CSS & JavaScript Toolbox plugin to version 12.0.3 or later.
2. Workaround: If update is not possible, disable the plugin until a patch can be applied.
3. WAF Rules: Deploy WAF rules to block path traversal patterns (e.g., file=../).
4. File Permissions: Ensure sensitive files (e.g., wp-config.php) have restrictive permissions.
5. Monitoring: Enable logging and monitoring for LFI attempts using the provided detection rules.
6. Least Privilege: Run web server processes with minimal file system access rights.

Valters IT
Securing Digital Frontiers