Snap Creek Duplicator up to 1.3.27 on WordPress duplicator_download/duplicator_init File path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Snap Creek Duplicator up to 1.3.27 on WordPress. The impacted element is the function duplicator_download/duplicator_init. The manipulation of the argument File with the input ../ results in path traversal. This vulnerability is reported as CVE-2020-11738. The attack can be launched remotely. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Snap Creek Duplicator up to 1.3.27 on WordPress (WordPress Plugin). Affected is the function duplicator_download/duplicator_init. The manipulation of the argument file with the input value ../ leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality. CVE summarizes:

The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traversal via ../ in the file parameter to duplicator_download or duplicator_init.

The weakness was disclosed 04/13/2020. This vulnerability is traded as CVE-2020-11738 since 04/13/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006.

The exploit is shared for download at exploit-db.com. It is declared as attacked. This issue was added on 11/03/2021 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 05/03/2022:

Apply updates per vendor instructions.

Upgrading to version 1.3.28 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (50420). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• Snap Creek Duplicator

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion