Overview
The Simple-File-List Plugin for WordPress, popular for file management among the WordPress community, has been found to contain a critical remote code execution vulnerability. Identified as CVE-2020-36847, this vulnerability poses a significant risk to any WordPress site using versions up to, and including, 4.2.2 of the plugin. Unauthenticated attackers can exploit this vulnerability to execute arbitrary code on the server, potentially compromising the system and leading to data leakage.
This vulnerability is of particular concern due to the high severity score of 9.8 assigned by CVSS, which reflects its potential impact on system integrity and confidentiality. The fact that this vulnerability can be exploited without the attacker requiring any prior authentication makes it all the more dangerous.
Vulnerability Summary
CVE ID: CVE-2020-36847
Severity: Critical (CVSS: 9.8)
Attack Vector: Remote
Privileges Required: None
User Interaction: None
Impact: System compromise and potential data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Simple-File-List Plugin for WordPress | Up to and including 4.2.2
How the Exploit Works
The vulnerability lies in the ‘rename’ function of the Simple-File-List plugin. An unauthenticated attacker can exploit this function to rename a previously uploaded PHP file disguised with a .png extension to a .php extension. Once the malicious PHP file is successfully renamed, it can be executed on the server, leading to remote code execution.
Conceptual Example Code
The following is a conceptual example of how the vulnerability might be exploited. This is a sample HTTP POST request that an attacker might use to rename a malicious file:
POST /wp-content/plugins/simple-file-list/ee-upload-engine.php HTTP/1.1
Host: vulnerable-site.com
fileOldName=malicious.png&fileNewName=malicious.phpIn this request, `fileOldName` parameter is the name of the already uploaded malicious file disguised as a .png file and `fileNewName` is the new name with a .php extension. After this request, the server will rename the file, and the PHP code can be executed remotely.
Mitigation Guidance
To mitigate this vulnerability, it is strongly advised to apply the vendor’s patch. If for some reason the patch cannot be applied promptly, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. These systems can be configured to block or alert on HTTP requests that attempt to rename files with a .php extension.