ChurcHope WordPress Theme: Arbitrary file download via path traversal (CVE-2014-125134)

The ChurcHope theme for WordPress, prior to version 2.2, contains a critical path traversal vulnerability. This flaw resides in the 'file' parameter of the 'downloadlink.php' script located at '/wp-content/themes/churchope/lib/downloadlink.php'. An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted HTTP GET requests containing directory traversal sequences (e.g., '../') to access files outside of the intended directory. Successful exploitation allows an attacker to retrieve sensitive configuration files such as 'wp-config.php', which often contains database credentials, or system files like '/etc/passwd'. This vulnerability has been subject to exploitation in the wild since October 18, 2023, as reported by the Shadowserver Foundation.

Attack Chain

1. Attacker performs reconnaissance on the target WordPress site to identify the use of the ChurcHope theme.
2. Attacker probes the known vulnerable path: '/wp-content/themes/churchope/lib/downloadlink.php'.
3. Attacker crafts an HTTP GET request with the 'file' parameter containing traversal payloads (e.g., 'file=../../wp-config.php').
4. The web server processes the request and passes the malicious path to the PHP script.
5. The application fails to sanitize the input, allowing the script to read the requested file from the filesystem.
6. The server returns the contents of the target sensitive file in the HTTP response body.
7. Attacker parses the returned file content to extract database passwords, keys, or other sensitive configuration data.
8. Attacker uses the harvested credentials for further unauthorized access or database manipulation.

Impact

Successful exploitation of this vulnerability leads to the disclosure of sensitive server-side information, including database credentials stored in 'wp-config.php'. This can result in complete site compromise, data exfiltration, or further unauthorized access to the underlying server environment.

Recommendation

1. Upgrade the ChurcHope WordPress theme to version 2.2 or later immediately to patch CVE-2014-125134.
2. Implement the provided Sigma rule in your webserver monitoring environment to detect attempts to exploit this specific directory traversal vector.
3. Review web server access logs for anomalous requests to 'downloadlink.php' that include '..' sequences in the query string.
4. If an exploit is identified, immediately rotate database credentials, security keys, and salts defined in 'wp-config.php'.