Aspose PDF Exporter: Path traversal vulnerability (CVE-2015-20125)

The Aspose PDF Exporter plugin for WordPress, in versions prior to 2.0, contains a path traversal vulnerability. This security flaw stems from the unsanitized input handled by the 'file' parameter within the 'aspose_pdf_exporter_download.php' script, which utilizes the 'readfile()' PHP function. Unauthenticated remote attackers can exploit this vulnerability by submitting specially crafted GET requests containing directory traversal sequences (e.g., ../) to the affected script. Successful exploitation allows an attacker to bypass file system restrictions and read sensitive files from the underlying server, such as 'wp-config.php', which typically contains database credentials. The Shadowserver Foundation reported observing in-the-wild exploitation of this vulnerability as early as October 2023. Organizations using this plugin must upgrade to version 2.0 or later to remediate the issue.

Impact

Successful exploitation of this vulnerability leads to the disclosure of sensitive server-side files, including WordPress configuration files containing database credentials. This can result in full database compromise, unauthorized administrative access to the WordPress instance, and further exploitation of the host environment.

Recommendation

• Update the Aspose PDF Exporter plugin to version 2.0 or later immediately to address CVE-2015-20125.
• Deploy the provided Sigma rule to detect attempts to access sensitive files using directory traversal sequences against the affected download script.
• Audit web server access logs for anomalous GET requests targeting 'aspose_pdf_exporter_download.php' with path traversal patterns (e.g., '../').