CVE-2023-6114
Published: 26 December 2023
Summary
CVE-2023-6114 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Awesomemotive Duplicator. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 1.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Duplicator WordPress plugin before version 1.5.7.1 and the Duplicator Pro plugin before 4.5.14.2 contain an information disclosure vulnerability tracked as CVE-2023-6114. The plugins fail to prevent directory listing of the backups-dup-lite/tmp or backups-dup-pro/tmp folders, which are used to temporarily store sensitive files including full database dumps and site archives. When the web server permits directory listing, these paths become accessible over the network, corresponding to CWE-552 and carrying a CVSS 3.1 score of 7.5.
Unauthenticated attackers can exploit the flaw remotely by directly requesting the exposed temporary directories. Successful access allows them to retrieve complete database exports and site backups, exposing credentials, user data, and other sensitive site contents without any authentication or user interaction required.
The EPSS score for this CVE reached a peak of 0.6672 with a current value of 0.6126, indicating sustained moderate exploitation interest following disclosure. No additional details on patch deployment or real-world exploitation campaigns are provided in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58369
Vulnerability details
The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in…
more
the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated directory listing exposure of temporary backup files (database dumps and site ZIP archives containing sensitive data/credentials) enables exploitation of public-facing app, file/directory discovery, collection from local system/databases, and unsecured credentials discovery.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Controls on authorized publication limit files and directories with nonpublic data from becoming accessible to external parties.
Controlling and documenting P2P file sharing prevents files and directories from being made accessible to external parties for unauthorized distribution.
Identifying and documenting file and directory locations allows restriction of access to external parties.
Protecting backup files ensures they are not accessible to external parties or unauthorized spheres.
Sanitizing equipment before off-site maintenance reduces the risk of files or directories containing sensitive data becoming accessible to external parties.
Policy restricts media access to authorized parties only, preventing exposure of resources to external or unauthorized actors.
Media access restrictions prevent files or directories from being accessible to external parties.
Employing and evaluating controls at documented alternate sites makes files and directories less likely to be accessible to external parties through physical or environmental weaknesses.