Triple Threat: Understanding the Combined Impact of CVE-2023-6971, CVE-2023-6972, and CVE-2023-7002 in ‘Backup Migration’ Plugin

Introduction:

In the world of WordPress security, the convergence of multiple vulnerabilities within a single plugin can create a perfect storm for attackers. This is precisely what’s happened with the ‘Backup Migration’ plugin, where three distinct CVEs (CVE-2023-6971, CVE-2023-6972, and CVE-2023-7002) combine to open the door for a severe exploit known as OS (Can’t Say the FOX’s name or WordPress Filters it now) Injections.

Breaking Down the Vulnerabilities:

1. CVE-2023-6971 – Remote File Inclusion via content-dir:
   • Discovered by Hiroho Shimada (NP3228), this vulnerability allows for remote file inclusion, potentially letting attackers upload malicious files to the server.
   • Wordfence Report
   • CVE Details
2. CVE-2023-6972 – Unauthenticated Path Traversal to Arbitrary File Deletion:
   • Also identified by Hiroho Shimada (NP3228), this flaw enables unauthenticated path traversal, leading to arbitrary file deletion. This can be exploited to remove critical files from the server.
   • Wordfence Report
   • CVE Details
3. CVE-2023-7002 – Authenticated OS Command Injection via URL:
   • Found by Franco Ataffarel, this vulnerability allows authenticated users (Admin+) to inject OS commands via a URL, potentially leading to complete server takeover.
   • Wordfence Report
   • CVE Details

The Combined Threat: OS Injections

When these vulnerabilities are exploited together, they can lead to an OS injection. This type of attack can give attackers deep access to the server, allowing them to manipulate, steal, or destroy data. It’s a serious threat that underscores the importance of keeping plugins up-to-date and monitoring for unusual activities.

Mitigation and Protection:

• Update Immediately: If you’re using ‘Backup Migration’, update it to the latest version without delay.
• Regular Scans: Use security tools like Sucuri, Wordfence, or Imunify360 to scan for vulnerabilities and malware.
• Strong Admin Protocols: Ensure that admin-level users follow strict security protocols to prevent the exploitation of CVE-2023-7002.
• Backup Regularly: Maintain regular backups of your WordPress site to recover quickly in case of an attack.

Conclusion:

The convergence of CVE-2023-6971, CVE-2023-6972, and CVE-2023-7002 in the ‘Backup Migration’ plugin presents a significant security challenge. By understanding these vulnerabilities and taking proactive steps, you can protect your WordPress site from potential exploits like OS Injections.