Local File Inclusion in BetterDocs Pro WordPress Plugin

Executive Summary

The BetterDocs Pro plugin for WordPress has a Local File Inclusion vulnerability in versions up to and including 3.8.0. This vulnerability exists via the `doc_style` parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server.

By exploiting this vulnerability, attackers can run any PHP code contained in those files, potentially bypassing access controls and gaining unauthorized access to sensitive data or executing malicious code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized code execution on the server hosting the WordPress site.

• Attackers can bypass access controls.
• Sensitive data stored on the server can be accessed or stolen.
• Malicious PHP code can be executed, potentially leading to full server compromise.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Local File Inclusion vulnerability in the BetterDocs Pro plugin for WordPress (versions up to and including 3.8.0), you should immediately update the plugin to a version later than 3.8.0 where the vulnerability is fixed.

Additionally, restrict or monitor uploads of .php files to prevent attackers from uploading malicious files that could be included and executed via the vulnerable parameter.

Implement access controls and security measures such as web application firewalls (WAF) to detect and block attempts to exploit the `doc_style` parameter.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the BetterDocs Pro plugin allows unauthenticated attackers to execute arbitrary PHP code on the server, potentially bypassing access controls and obtaining sensitive data.

Such unauthorized access and potential data exposure could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls to protect sensitive personal and health information.

However, the provided information does not explicitly mention the impact on compliance with these or other standards.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Local File Inclusion via the `doc_style` parameter in BetterDocs Pro plugin versions up to 3.8.0. To detect it on your system, you can attempt to identify if your WordPress installation is running a vulnerable version of the BetterDocs Pro plugin.

One approach is to check the plugin version directly from the WordPress admin dashboard or by inspecting the plugin files on the server.

To detect exploitation attempts or probe for the vulnerability on your network, you can monitor HTTP requests targeting the `doc_style` parameter for suspicious input that attempts to include local files, such as requests containing `doc_style=../../` or similar directory traversal patterns.

Example commands to help detect the vulnerability or exploitation attempts include:

• Using grep on web server logs to find suspicious requests: `grep -i 'doc_style=' /var/log/apache2/access.log`
• Using curl to test if the vulnerability exists by sending a crafted request (replace example.com with your domain): `curl -v 'https://example.com/wp-content/plugins/betterdocs-pro/?doc_style=../../../../etc/passwd'`
• Using WP-CLI to check the installed plugin version: `wp plugin list --status=active | grep betterdocs`

If the plugin version is 3.8.0 or lower, it is vulnerable and should be updated immediately.

Useful 0 Not Useful 0