WooThemes Diarise: Arbitrary file read vulnerability (CVE-2019-25779)

WooThemes Diarise through version 1.5.9 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this via the calendar parameter in download.php by passing a file:// scheme path. This allows for the disclosure of sensitive files such as /etc/passwd. Active exploitation of this vulnerability was documented by the Shadowserver Foundation starting on 2023-10-19.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the underlying server filesystem, potentially leading to the disclosure of configuration files, credentials, or system information.

Recommendation

• Update WooThemes Diarise to the latest version if available, or remove the plugin if it is not business-critical.
• Monitor web server access logs for requests to download.php where the calendar parameter contains a file scheme URI.
• Restrict access to web application files and sanitize all user-supplied input used in file operations.