Aspose Importer & Exporter: Path traversal vulnerability (CVE-2015-20124)

The Aspose Importer & Exporter plugin for WordPress, in versions prior to 3.0, is vulnerable to a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the underlying server filesystem. The vulnerability exists due to improper sanitization of the 'file' parameter within the 'aspose_import_export_download.php' script. By providing a crafted path containing directory traversal sequences (such as '../'), an attacker can escape the web root and access sensitive system or application files, including 'wp-config.php', which typically contains database credentials and encryption salts. This vulnerability has been subject to active exploitation in the wild, as noted by the Shadowserver Foundation.

Impact

Successful exploitation allows for the unauthorized disclosure of sensitive server-side files. Access to 'wp-config.php' can lead to full compromise of the WordPress site, including complete database access, which may be leveraged to inject malicious content, create administrative accounts, or extract sensitive user data.

Recommendation

• Upgrade the Aspose Importer & Exporter plugin to version 3.0 or later immediately.
• Review web server access logs for requests containing directory traversal sequences directed at 'aspose_import_export_download.php'.
• Perform a security audit of site configurations if the plugin was installed and exposed to the internet.
• Deploy the provided Sigma rule to detect and alert on exploitation attempts against this endpoint.