A Vulnerability in WordPress Duplicator Plugin Could Allow for Arbitrary File Downloads

ITS Advisory Number: 
2020-031
Date(s) Issued: 
Tuesday, March 3, 2020
Subject: 
A Vulnerability in WordPress Duplicator Plugin Could Allow for Arbitrary File Downloads
Overview: 

A vulnerability has been discovered in the WordPress Duplicator Plugin that could allow for Arbitrary File Downloads. WordPress is a web-based publishing application implemented in PHP, and the WordPress Duplicator Plugin helps site administrators migrate and copy WordPress sites. Successful exploitation of this vulnerability could allow for Arbitrary File Downloads.

 

THREAT INTELLIGENCE:

There are reports that this vulnerability is being exploited in the wild.

 

Systems Affected: 
  • WordPress Duplicator Plugin prior to 1.3.28

RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
Medium
BUSINESS
Large and medium business entities: 
High
Small business entities: 
Medium
Home Users: 
Low
Description: 

A vulnerability has been discovered in the WordPress Duplicator Plugin that could allow for Arbitrary File Downloads. This vulnerability exists due to the way Duplicator handles certain requests from unauthenticated users. When an attacker sends a specially crafted request to Duplicator, an unauthenticated user can download arbitrary files from the target WordPress site. This includes the 'wp-config.php' file, which contains various site configurations, and potentially database credentials. Successful exploitation of this vulnerability could allow for Arbitrary File Downloads.

Actions: 
  • Verify no unauthorized system modifications have occurred on system before applying patch.

  • After appropriate testing, immediately apply updates provided by Duplicator to affected systems.

  • Apply the Principle of Least Privilege to all systems and services.

  • Monitor intrusion detection systems for any signs of anomalous activity.

  • Unless required, limit external network access to affected products.