Zero-Day Vulnerability in the Duplicator Plugin for WordPress

Duplicator is a very useful plugin for those users who want to migrate/copy WordPress sites. With Duplicator, administrators can create a new copy of the site and the generated backup file can be downloaded from the WP dashboard.

The Zero-Day Vulnerability of the Duplicator Plugin. Exploiting the discovered zero-day vulnerability allows hackers to arbitrarily download files from target sites. More than 1 million WordPress websites are affected by this security issue.

When a user creates a copy of a WP site and clicks the "Download" button, the WordPress AJAX handler is called with the duplicator_download action and the file parameter.

Unfortunately the duplicator_download action was registered through wp_ajax_nopriv_ and was therefore accessible to unauthenticated users. To make matters worse, there was no validation to limit the locations from which files could be downloaded.

The file parameter was passed through sanitize_text_field and added to the plugin constant DUPLICATOR_SSDIR_PATH , however a Directory Traversal attack was still possible. An attacker could access files outside the Duplicator folder, sending values ​​like ../../../file.php to navigate through the server's folder structure.

WordFence function duplicator_init() { if (isset($_GET['action']) && $_GET['action'] == 'duplicator_download') { $file = sanitize_text_field($_GET['file']); $filepath = DUPLICATOR_SSDIR_PATH.'/'.$file; // Process download if(file_exists($filepath)) { // Clean output buffer if (ob_get_level() !== 0 && @ob_end_clean() === FALSE) { @ob_clean(); } header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="'.basename($filepath).'"'); header('Expires: 0'); header('Cache-Control: must-revalidate'); header('Pragma: public'); header('Content-Length: ' . filesize($filepath)); flush(); // Flush system output buffer try { $fp = @fopen($filepath, 'r'); if (false === $fp) { throw new Exception('Fail to open the file '.$filepath); } while (!feof($fp) && ($data = fread($fp, DUPLICATOR_BUFFER_READ_WRITE_SIZE)) !== FALSE) { echo $data; } @fclose($fp); } catch (Exception $e) { readfile($filepath); } exit; } else { wp_die('Invalid installer file name!!'); } } } add_action('init', 'duplicator_init'); What are the signs that this vulnerability has been exploited? Finding the following strings in a GET request indicates that the site has most likely been the subject of hacker attention.

action=duplicator_download

If your site is on Host, it is safe. If your site is on Host.it you have nothing to fear, in fact all our new shared hosting profiles (Host Agile, Smart, Genius, 4.0 and 5.0) and cloud hosting (Host Cloud) are protected by Cerbero, a sophisticated protection system that includes an innovative Web Application Firewall.

Cerberus definitions were updated immediately to prevent and block attacks aimed at exploiting the Duplicator vulnerability in WordPress.