CVE-2020-28039: WordPress Path Traversal Vulnerability

CVE-2020-28039 Overview

CVE-2020-28039 is an arbitrary file deletion vulnerability in WordPress affecting the is_protected_meta function in wp-includes/meta.php. The vulnerability exists because WordPress versions prior to 5.5.2 do not properly determine whether a meta key is considered protected, allowing attackers to delete arbitrary files on the server through improper meta key validation.

Critical Impact

This vulnerability allows unauthenticated remote attackers to delete arbitrary files on WordPress installations, potentially leading to complete site compromise, data loss, or enabling further attacks by removing critical security files.

Affected Products

• WordPress versions before 5.5.2
• Debian Linux 9.0, 10.0
• Ubuntu Linux 16.04 ESM, 18.04 LTS, 20.04 LTS

Discovery Timeline

• 2020-10-29 - WordPress releases security patch in version 5.5.2
• 2020-11-02 - CVE-2020-28039 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-28039

Vulnerability Analysis

The vulnerability resides in the is_protected_meta() function within WordPress core. This function is responsible for determining whether a given meta key should be protected from modification or deletion. Due to insufficient validation logic, the function fails to properly identify certain meta keys as protected, creating a security gap that can be exploited to perform unauthorized file operations.

When exploited, this vulnerability allows attackers to bypass the intended protection mechanisms and delete arbitrary files on the filesystem. The impact is significant as it can affect both the integrity and availability of the WordPress installation. An attacker could delete critical configuration files like wp-config.php, effectively taking the site offline or triggering WordPress's installation wizard, which could then be exploited for further compromise.

Root Cause

The root cause of this vulnerability is improper input validation in the is_protected_meta() function. The function does not correctly evaluate all conditions that should designate a meta key as protected. This logic flaw allows specially crafted meta key values to bypass the protection check, enabling file deletion operations that should otherwise be blocked.

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker can craft malicious requests that manipulate meta key values to trigger file deletion operations. The attack requires no user interaction and can be executed against any vulnerable WordPress installation accessible over the network.

The exploitation leverages the improper meta key validation to reference files that should be protected from deletion. By supplying a specially crafted meta key value that bypasses the is_protected_meta() check, an attacker can instruct WordPress to delete arbitrary files on the server filesystem.

For technical implementation details, refer to the GitHub WordPress Commit that addresses this vulnerability.

Detection Methods for CVE-2020-28039

Indicators of Compromise

• Unexpected deletion of WordPress core files, themes, or plugins
• Missing wp-config.php or other critical configuration files
• WordPress site displaying installation wizard unexpectedly
• Web server error logs showing file not found errors for previously existing files

Detection Strategies

• Monitor WordPress file integrity using file integrity monitoring (FIM) solutions
• Implement web application firewall (WAF) rules to detect suspicious meta-related requests
• Review web server access logs for unusual POST requests targeting WordPress meta endpoints
• Deploy SentinelOne endpoint protection to detect and prevent malicious file operations

Monitoring Recommendations

• Enable WordPress audit logging to track all file system operations
• Configure alerts for deletion of critical WordPress files (wp-config.php, .htaccess, wp-settings.php)
• Monitor for mass file deletion events or patterns indicative of exploitation
• Set up real-time alerts for changes to WordPress core file structure

How to Mitigate CVE-2020-28039

Immediate Actions Required

• Upgrade WordPress to version 5.5.2 or later immediately
• Verify WordPress core file integrity using wp core verify-checksums command
• Review recent file system changes and restore any deleted files from backup
• Implement web application firewall rules to block potential exploitation attempts

Patch Information

WordPress addressed this vulnerability in version 5.5.2 released on October 29, 2020. The fix properly validates meta keys to ensure protected status is correctly determined. The patch is available through the official WordPress Security Release. Linux distribution-specific patches are available through Debian Security Advisory DSA-4784 and the Debian LTS Announcement.

Workarounds

• Restrict write permissions on critical files using filesystem permissions
• Implement additional access controls at the web server level
• Use a web application firewall to filter malicious requests
• Consider placing WordPress in read-only mode if immediate patching is not possible

# Secure critical WordPress files with restricted permissions
chmod 400 wp-config.php
chmod 444 .htaccess

# Verify WordPress installation integrity
wp core verify-checksums

# Update WordPress to the patched version
wp core update --version=5.5.2