Unauthenticated Remote Code Execution in WordPress Media Library Assistant Plugin

CVE-2023-4634 is a critical vulnerability affecting the WordPress Media Library Assistant plugin versions prior to 3.10. The vulnerability stems from insecure handling of image processing via the Imagick library, allowing an unauthenticated attacker to achieve remote code execution (RCE). By orchestrating a complex interaction between a target WordPress site and remote attacker-controlled FTP and HTTP servers, an adversary can force the server to download and process malicious SVG/MSL (Magick Scripting Language) files. This process ultimately results in the creation of a polyglot PHP file on the web server, which provides the attacker with command execution capabilities. Due to the public availability of functional exploit scripts, this vulnerability presents an immediate risk to organizations running unpatched versions of the plugin.

Attack Chain

1. Attacker sets up a remote FTP server hosting crafted polyglot SVG/MSL files and a remote HTTP server hosting a polyglot PNG/PHP file containing a web shell payload.
2. Attacker identifies a target WordPress site running a vulnerable version of the Media Library Assistant plugin.
3. Attacker triggers the vulnerability by sending a request to the target site, pointing it to the malicious files hosted on the attacker's FTP server.
4. The plugin's image processing function, utilizing the Imagick library, fetches and processes the malicious SVG/MSL files from the FTP server.
5. The processing of the MSL script instructs the server to fetch the polyglot PNG/PHP file from the attacker's HTTP server.
6. The Imagick library saves the fetched PNG content as a .php file on the victim's filesystem, typically within the web server's document root.
7. The attacker accesses the newly dropped PHP file directly via a web browser to execute the included payload and achieve arbitrary command execution.

Impact

Successful exploitation leads to full compromise of the underlying web server, allowing for unauthorized data access, modification, or the installation of persistent backdoors. The vulnerability has a CVSS 9.8 score, reflecting its high potential for complete system takeover without requiring authentication or user interaction.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the Media Library Assistant WordPress plugin to version 3.10 or later immediately to resolve CVE-2023-4634.
• Audit web server access logs for anomalous requests to the WordPress media upload or library endpoints that reference external, non-whitelisted domains or protocols (e.g., ftp://).
• Monitor the web server filesystem for the creation of unexpected .php files within standard image/media upload directories.
• Restrict the ability of the web server process (e.g., www-data) to initiate outbound network connections to arbitrary external hosts, specifically limiting FTP and high-port HTTP requests.