CVE-2023-6971
Published: 23 December 2023
Summary
CVE-2023-6971 is a high-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Backupbliss Backup Migration. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 7.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Backup Migration plugin for WordPress is affected by a remote file inclusion vulnerability in versions 1.0.8 through 1.3.9. The flaw resides in the backup-heart.php component and is triggered when an attacker supplies a remote path via the content-dir HTTP header, allowing inclusion of external files that result in code execution. Exploitation requires the target server's php.ini to have allow_url_include set to on, a setting that is disabled by default in PHP 7.4 and later.
Unauthenticated remote attackers can exploit the issue over the network without user interaction. By crafting a request that references a malicious remote file, an attacker can achieve arbitrary code execution on the server, provided the non-default PHP configuration is present. The CVSS 3.1 score of 8.1 reflects the high impact on confidentiality, integrity, and availability under these conditions.
References to the WordPress plugin repository document a changeset that patches the vulnerable code path, and the associated security advisory recommends updating the Backup Migration plugin to a version beyond 1.3.9 to eliminate the inclusion vector.
The EPSS score has remained flat at 0.0906 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59167
Vulnerability details
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution.…
more
NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Limiting P2P file sharing technology reduces inclusion of functionality or resources from untrusted external control spheres.
Enforcing installation policies prevents users from including functionality obtained from untrusted control spheres.
The inventory process requires identifying and recording the origin of all components, making inclusion of functionality from untrusted control spheres easier to detect during reviews.
Requiring approval and monitoring of maintenance tools prevents inclusion and execution of functionality obtained from untrusted sources.
Unowned portable devices represent untrusted control spheres; the prohibition prevents inclusion of functionality or data from such sources.
Strategy mandates assessment of third-party components and suppliers, directly reducing inclusion of functionality from untrusted control spheres.
Procedures can mandate supply-chain vetting and restrictions on functionality obtained from untrusted third-party or external control spheres.
Requires use of trusted sources and provenance tracking, tangibly limiting inclusion of functionality from untrusted control spheres.