cbcvebase.
CVE-2020-35948
published 2021-01-01

CVE-2020-35948: An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary…

PriorityP273high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
24.94%
97.6th percentile
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.

Affected

1 ranges
VendorProductVersion rangeFixed in
xclonerxcloner>= 4.2.1 < 4.2.134.2.13

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<target>:<port><wp_path>wp-login.php↗
urlhttp://192.168.0.38:80/wordpress//wp-admin/admin-ajax.php?action=restore_backup↗
path/wp-admin/admin-ajax.php?action=restore_backup↗
filenamexcloner_restore.php↗
commandaction=restore_backup↗
  • →Monitor POST requests to /wp-admin/admin-ajax.php with the query parameter action=restore_backup, which is the exploit trigger endpoint for CVE-2020-35948. ↗
  • →Alert on any write or modification of wp-config.php originating from the web server process, as the exploit abuses write_file_action in xcloner_restore.php to overwrite it. ↗
  • →Look for authenticated WordPress sessions immediately followed by POST requests to admin-ajax.php?action=restore_backup, indicating exploitation by a logged-in attacker. ↗
  • →Flag creation or modification of arbitrary PHP files under the WordPress directory by the web server process, as successful exploitation results in remote code execution via PHP file write. ↗
  • ·The exploit requires valid WordPress credentials; unauthenticated exploitation is not possible. Detection rules should account for the authentication step preceding the exploit POST. ↗
  • ·The multipart boundary value (------------------------08425016980d7357) is hardcoded in the public PoC exploit and may be used as a signature, but attackers can trivially change it. ↗
  • ·Affected versions span 4.2.1 through 4.2.12; only installations running XCloner Backup and Restore before 4.2.13 are vulnerable. ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.