Unauthenticated Arbitrary File Deletion in WP-BusinessDirectory

Executive Summary

The WP-BusinessDirectory plugin for WordPress has a vulnerability in versions up to and including 4.0.1 that allows unauthenticated arbitrary file deletion. This happens because the plugin's remove() method does not properly validate file paths. Specifically, the task=upload.remove endpoint can be accessed without authentication, and it accepts a _filename parameter without sanitization. The helper function makePathFile() only normalizes directory separators but does not remove path traversal sequences like ../. When combined with the _path_type=2 parameter, which sets the base directory to the plugin's site folder, an attacker can use ../ sequences in the _filename to traverse outside the plugin directory and delete arbitrary files on the server using PHP's unlink() function.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an unauthenticated attacker to delete arbitrary files on the server hosting the WordPress site. Critical files such as wp-config.php, wp-config-backup.php, or other important server files accessible to the web server process can be deleted. This can lead to site downtime, loss of configuration, data loss, and potentially compromise the integrity and availability of the website.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unauthenticated arbitrary file deletion via the task=upload.remove endpoint with specific parameters allowing path traversal. Detection can focus on monitoring HTTP requests to this endpoint that include the _filename parameter with suspicious path traversal sequences (e.g., ../).

You can detect attempts by inspecting web server logs or using network monitoring tools to filter for requests to the vulnerable endpoint.

• Use grep or similar tools on web server access logs to find suspicious requests: grep 'task=upload.remove' /var/log/apache2/access.log | grep '_filename=..'
• Use a network monitoring tool or IDS to alert on HTTP requests containing 'task=upload.remove' with '../' sequences in parameters.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the WP-BusinessDirectory plugin to a version later than 4.0.1 where this vulnerability is fixed.

If an update is not immediately possible, restrict access to the task=upload.remove endpoint by implementing firewall rules or web server configuration to block unauthenticated requests to this endpoint.

Additionally, monitor and audit file deletions on the server, especially critical files like wp-config.php, to detect any exploitation attempts.

Useful 0 Not Useful 0