NativeChurch WordPress theme path traversal (CVE-2014-125133)

The NativeChurch theme for WordPress, in versions prior to 1.6.2, contains a critical path traversal vulnerability within the 'download.php' script. This vulnerability allows an unauthenticated, remote attacker to manipulate the 'file' parameter in a GET request to access sensitive files outside of the intended directory. By utilizing directory traversal sequences (e.g., '../'), an attacker can retrieve configuration files such as 'wp-config.php', which typically contains database credentials and other security-sensitive information. This vulnerability was reportedly observed in the wild by the Shadowserver Foundation as early as October 2023. Given the ease of exploitation, organizations running this specific theme must update to version 1.6.2 or later to mitigate the risk of information disclosure and potential account takeover or database compromise.

Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running the vulnerable NativeChurch theme.
2. Attacker crafts a malicious HTTP GET request targeting 'download.php'.
3. Attacker appends directory traversal sequences (e.g., '../../wp-config.php') to the 'file' parameter.
4. The web server process receives the crafted request and fails to sanitize the path input.
5. The application logic passes the unsanitized path to the file system API.
6. The file system retrieves the contents of the requested file (e.g., 'wp-config.php') from outside the intended base directory.
7. The server returns the sensitive file content in the HTTP response body.
8. Attacker parses the response to extract credentials or configuration data for further exploitation.

Impact

Successful exploitation allows unauthenticated attackers to read sensitive files on the server. The primary impact is the unauthorized disclosure of 'wp-config.php', which often contains database hostnames, usernames, and passwords. This exposure can lead to full database compromise, subsequent secondary exploitation of the site, and the potential for complete site takeover.

Recommendation

• Update the NativeChurch WordPress theme to version 1.6.2 or later immediately to patch CVE-2014-125133.
• Deploy the provided Sigma rule to web server access logs to detect and block attempts to use directory traversal sequences within the 'download.php' file parameter.
• Audit web server logs for HTTP 200 responses to 'download.php' requests that contain 'wp-config.php' in the query string.