WordPress Plugin Advanced Custom Fields Remote File Inclusion

A Remote File Inclusion vulnerability exists in the Advanced Custom Fields plugin for WordPress. Unsafe usage of PHP’s array_merge function allows attackers to overwrite data to potentially achieve remote code execution.

Exploitation

Stages

1. Attacker sends a specially crafted request to ‘advanced-custom-fields/core/actions/export.php’, populating the ‘acf_abspath’ parameter with an attacker-controlled host.
2. The ‘acf_abspath’ parameter is passed to a require_once call, resulting in file inclusion from the specified host.

Prerequisites

You will need the WordPress plugin Advanced Custom Fields with a version before 3.5.2.

Vulnerability Description

A Remote File Inclusion vulnerability exists in the Advanced Custom Fields plugin for WordPress. The vulnerability lies in script /core/actions/export.php. This script contains unsafe usage of PHP’s array_merge, allowing attackers to overwrite an included variable via specially crafted requests. This can result in remote code execution. No authentication is required for successful execution of this attack.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

• Disable or restrict access to the plugin until a patch can be applied.
• Upgrade the plugin to the most recent patched version.