CVE-2023-1381
Published: 10 April 2023
Summary
CVE-2023-1381 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Joomunited Wp Meta Seo. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The WP Meta SEO WordPress plugin before version 4.5.5 is affected by a PHAR deserialization vulnerability stemming from missing validation of image file paths prior to file manipulation. The plugin also includes a gadget chain that can be leveraged in certain configurations to reach remote code execution. The issue is tracked as CWE-502 and carries a CVSS 3.1 score of 8.8.
An authenticated user with low privileges can supply a crafted image path over the network to trigger deserialization and, where the gadget chain is usable, obtain arbitrary code execution on the server. No user interaction is required and the attack does not cross trust boundaries.
Public advisories from WPScan identify the flaw and point to the availability of a fixed release; administrators are expected to update the plugin to version 4.5.5 or later. The associated EPSS score reached a peak of 0.1066 before receding to its current value of 0.0951, indicating moderate and slightly declining exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-23637
Vulnerability details
The WP Meta SEO WordPress plugin before 4.5.5 does not validate image file paths before attempting to manipulate the image files, leading to a PHAR deserialization vulnerability. Furthermore, the plugin contains a gadget chain which may be used in certain…
more
configurations to achieve remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.