CVE-2023-5815: News & Blog Designer Pack RCE Vulnerability

CVE-2023-5815 Overview

CVE-2023-5815 is a critical Remote Code Execution (RCE) vulnerability affecting the News & Blog Designer Pack plugin for WordPress. This vulnerability allows unauthenticated attackers to execute arbitrary PHP code through Local File Inclusion (LFI) in all versions up to and including 3.4.1. The flaw exists in the bdp_get_more_post function, which is accessible via a nopriv AJAX endpoint, meaning no authentication is required to exploit it.

Critical Impact

Unauthenticated attackers can achieve complete server compromise through remote code execution, potentially gaining full control of the WordPress installation and underlying server infrastructure.

Affected Products

• Infornweb News & Blog Designer Pack versions up to and including 3.4.1
• WordPress installations using the Blog Designer Pack plugin (blog-designer-pack)
• Vulnerable Docker configurations running affected versions may be at higher risk for PHP file creation attacks

Discovery Timeline

• 2023-11-22 - CVE-2023-5815 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-5815

Vulnerability Analysis

This vulnerability combines two dangerous programming practices that, when chained together, enable unauthenticated remote code execution. The vulnerable bdp_get_more_post function is registered as a WordPress AJAX handler that can be accessed without authentication (via wp_ajax_nopriv_ hook), exposing it to any remote attacker.

The exploitation chain requires two conditions: first, the unsafe use of PHP's extract() function on user-controlled POST data, which allows attackers to overwrite internal variables; second, the subsequent passing of attacker-controlled values to PHP's include() function, enabling arbitrary file inclusion. On systems with writable directories or certain Docker configurations, attackers may be able to create malicious PHP files and then include them to achieve full code execution.

Root Cause

The root cause is the unsafe implementation of the extract() function on untrusted user input from the POST variable. The extract() function in PHP imports variables from an array into the current symbol table, and when used on user-controlled data without proper filtering, it allows attackers to overwrite any variable in scope. This variable overwrite capability is then weaponized because the function passes the manipulated values directly to an include() statement, creating a Local File Inclusion vulnerability that can be escalated to Remote Code Execution.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send a specially crafted POST request to the WordPress AJAX endpoint targeting the bdp_get_more_post action. By manipulating the POST parameters, the attacker can inject malicious values that get extracted into the function's variable scope. These manipulated variables are then used in an include() call, allowing the attacker to include arbitrary PHP files.

On vulnerable Docker configurations, as documented in external research on PHP file inclusion techniques, an attacker may leverage writable locations or PEAR command execution (pearcmd.php) to first create a malicious PHP file on the system and then include it to achieve code execution. This attack methodology is particularly effective in containerized environments where certain PHP configurations may be more permissive.

Detection Methods for CVE-2023-5815

Indicators of Compromise

• Unusual POST requests to /wp-admin/admin-ajax.php with action=bdp_get_more_post parameter
• Web server logs showing access patterns targeting AJAX endpoints with suspicious file path patterns in POST data
• Unexpected PHP files appearing in web-accessible or writable directories
• Evidence of pearcmd.php access or PEAR-related file operations in logs

Detection Strategies

• Monitor WordPress AJAX endpoints for requests to the bdp_get_more_post action from unauthenticated sessions
• Implement web application firewall (WAF) rules to detect LFI patterns including path traversal sequences and PHP file references in POST data
• Deploy file integrity monitoring on WordPress installations to detect unauthorized file creation or modification
• Review web server access logs for POST requests with abnormal payload sizes or patterns targeting admin-ajax.php

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and review for anomalous patterns
• Implement real-time alerting for failed or successful file inclusion attempts using security monitoring tools
• Monitor for process spawning from PHP workers that may indicate successful code execution
• Deploy endpoint detection solutions to identify post-exploitation activities such as web shell deployment or reverse shell connections

How to Mitigate CVE-2023-5815

Immediate Actions Required

• Update the News & Blog Designer Pack plugin to version 3.4.2 or later immediately
• Audit WordPress installations for the presence of vulnerable plugin versions using wp plugin list or similar tools
• Review web server logs for evidence of exploitation attempts against the bdp_get_more_post AJAX action
• Consider temporarily disabling the plugin if immediate updates are not feasible

Patch Information

The vendor has released a security patch addressing this vulnerability. The fix can be reviewed in the WordPress Plugin Changeset. Users should update to version 3.4.2 or later through the WordPress admin dashboard or by downloading the updated plugin from the WordPress Plugin Directory. Additional vulnerability intelligence is available from Wordfence.

Workarounds

• Implement WAF rules to block POST requests containing path traversal patterns or PHP file references targeting the vulnerable AJAX endpoint
• Restrict access to admin-ajax.php for specific sensitive actions if the plugin cannot be immediately updated
• Apply PHP configuration hardening by disabling dangerous functions and restricting open_basedir to limit file inclusion scope
• In Docker environments, ensure proper file system permissions and consider read-only mounting for PHP directories

# Configuration example - Apache .htaccess rule to block suspicious AJAX requests
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{REQUEST_URI} admin-ajax\.php
    RewriteCond %{QUERY_STRING} action=bdp_get_more_post [NC,OR]
    RewriteCond %{HTTP:Content-Type} bdp_get_more_post [NC]
    RewriteRule .* - [F,L]
</IfModule>