WordPress File Manager RCE flaw exploited

17 September 2020 high vulnerability technology

A code execution vulnerability in the WordPress File Manager plugin (CVE-2020-25213) is being actively exploited, allowing unauthenticated attackers to upload malicious files.

IPA (Japan's Information-technology Promotion Agency) issued an urgent alert regarding CVE-2020-25213, a vulnerability in the popular WordPress plugin "File Manager," which adds file upload, deletion, and management capabilities to WordPress sites. The flaw allows an unauthenticated remote attacker to upload arbitrary malicious files and achieve remote code execution on affected servers.

IPA states that exploitation of this vulnerability has been observed in the wild, and urges administrators running the File Manager plugin to update immediately to the patched version released by the developer. Given the plugin's wide install base and the ease of exploitation (unauthenticated file upload leading to code execution), this represents a significant risk to WordPress site operators who have not yet applied the fix.

Mentioned in this report

Vulnerabilities CVE-2020-25213KEV

Detection guidance

WordPress File Manager Plugin Exploit Attempt via connector.minimal.php

ATT&CK T1190

Detects HTTP requests to the vulnerable File Manager plugin connector endpoint attempting arbitrary file upload/rename consistent with CVE-2020-25213 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WordPress File Manager Plugin Exploit Attempt
id: 79c4faba-4d23-5e7c-a663-7b3c90b58d60
status: experimental
description: Detects requests to the WordPress File Manager plugin's connector.minimal.php
  endpoint with upload or rename actions, consistent with exploitation of CVE-2020-25213
  allowing unauthenticated arbitrary file upload leading to RCE.
references:
- https://www.ipa.go.jp
logsource:
  category: webserver
  product: windows
detection:
  selection:
    cs-uri-stem|contains: wp-file-manager
  connector:
    cs-uri-stem|contains: connector.minimal.php
  action:
    cs-uri-query|contains:
    - cmd=upload
    - cmd=rename
    - target=l1
  condition: selection and connector and action
falsepositives:
- Legitimate administrative use of the File Manager plugin's upload/rename functionality
  by site editors
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant

PHP Webshell File Written into WordPress File Manager Plugin Directory

ATT&CK T1505.003

Detects creation of PHP files within the wp-file-manager plugin directory structure, which may indicate a webshell dropped via CVE-2020-25213 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP Webshell Dropped in WordPress File Manager Directory
id: dccef94b-dcea-52e1-a0ad-00ab8a6b2d57
status: experimental
description: Detects file creation events for .php files inside the wp-file-manager
  plugin path (uploads/lib directories), a known technique used after exploiting CVE-2020-25213
  to drop a webshell for persistent remote code execution.
references:
- https://www.ipa.go.jp
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains: wp-file-manager
    TargetFilename|endswith: .php
  filter:
    TargetFilename|contains:
    - /lib/php/
    - /js/
    - /css/
  condition: selection and not filter
falsepositives:
- Legitimate plugin update or reinstall writing core PHP files to the plugin directory
- Developer customization of the plugin source files
level: high
tags:
- attack.t1505.003
- attack.persistence
author: Vorant

Web Server Process Spawning Shell Consistent with Webshell Execution

ATT&CK T1505.003

Detects a web server or PHP-FPM process spawning a command shell, a common indicator of webshell command execution following exploitation of a WordPress plugin RCE such as CVE-2020-25213. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Spawning Command Shell (Possible Webshell)
id: 2d369277-417b-5e51-ae78-50526dce67ee
status: experimental
description: Detects child processes such as cmd.exe, powershell.exe, sh, or bash
  being spawned by common web server or PHP process images, which can indicate a webshell
  dropped after exploitation of a WordPress plugin vulnerability like CVE-2020-25213
  executing attacker-supplied commands.
references:
- https://www.ipa.go.jp
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \\httpd.exe
    - \\nginx.exe
    - \\php-cgi.exe
    - \\php.exe
    - \\w3wp.exe
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\sh.exe
    - \\bash.exe
  condition: selection
falsepositives:
- Administrative scripts or health-check tooling that legitimately invoke shell commands
  from the web server process
- Custom PHP applications that intentionally shell out for automation tasks
level: medium
tags:
- attack.t1505.003
- attack.t1190
- attack.execution
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2020/alert20200918.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free