Aspose Doc Exporter: Path traversal vulnerability (CVE-2015-20123)

The Aspose Doc Exporter plugin for WordPress, specifically versions prior to 2.0, contains a path traversal vulnerability originating from improper input sanitization in the readfile() function. The flaw allows unauthenticated remote attackers to bypass directory restrictions and access arbitrary files on the web server. By crafting malicious GET requests to the aspose_doc_exporter_download.php script and manipulating the file parameter, an attacker can traverse the directory structure to retrieve sensitive configuration files, such as wp-config.php. Access to this file typically results in the exposure of database credentials, which can lead to full site takeover or further internal network compromise. This vulnerability has been subject to active exploitation in the wild since at least October 2023.

Attack Chain

1. Attacker performs reconnaissance to identify sites running the vulnerable Aspose Doc Exporter WordPress plugin.
2. Attacker crafts an HTTP GET request targeting the aspose_doc_exporter_download.php endpoint.
3. Attacker appends a malicious path traversal string to the file parameter (e.g., ../../../wp-config.php).
4. The web server processes the request and executes the readfile() function with the unsanitized user input.
5. The application returns the contents of the target system file in the HTTP response body.
6. Attacker parses the response to extract cleartext database credentials or other sensitive configuration data.
7. Attacker uses stolen credentials to access the backend database or authenticates as a high-privileged user.
8. Attacker achieves unauthorized access to the application data or proceeds with further lateral movement.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive server-side files. For WordPress environments, the most common target is wp-config.php, which contains hardcoded database host, username, and password information. This exposure enables attackers to modify the database, inject malicious content into the site, or exfiltrate customer data, leading to total site compromise.

Recommendation

• Update the Aspose Doc Exporter plugin to version 2.0 or later immediately to apply the vendor-provided patch.
• Monitor web server logs for requests to aspose_doc_exporter_download.php containing directory traversal patterns like ../, ..%2f, or ..%5c.
• Use the Sigma rule provided below to detect exploitation attempts targeting this specific endpoint.