Advanced Custom Fields <= 5.7.11 - PHP Object Injection

2019-02-15 00:00
Slavco Mihajloski

Strategic Overview

Status
Patched in 5.7.12
Affected Plugin
Advanced Custom Fields (ACF®)
Affected Version
<= 5.7.11
CVSS
5.4Medium
Weakness type
CWE-502 · Deserialization of Untrusted Data
CVE
CVE pending
View all Advanced Custom Fields (ACF®) vulnerabilities

At a glance

This record tracks a medium-severity Deserialization of Untrusted Data vulnerability in the Advanced Custom Fields (ACF®) WordPress plugin, affecting versions <= 5.7.11. It carries a CVSS score of 5.4 (reachable over the network; low attack complexity). The issue is fixed in version 5.7.12; sites on affected versions should update now. Disclosed February 2019, reported by Slavco Mihajloski.

Vulnerability Overview

Advanced Custom Fields before 5.7.12 fails to sanitize user-supplied input before passing it to the unserialize() function. This allows low-level authenticated users to call PHP Objects and possibly achieve remote code execution if a usable gadget is present in a plugin or theme installed on the same site as the vulnerable plugin.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-502: Deserialization of Untrusted Data

Advanced Custom Fields (ACF®) <= 5.7.11 carries this weakness at unserialize(), and reaching it takes a caller who can reach the endpoint. Deserialization of untrusted data means the application reconstructs objects from input a caller controls, letting the attacker choose which classes get instantiated and what their properties hold.

A workable chain turns deserialization into file writes, deletions or code execution, depending on what the loaded classes do in their magic methods. For Advanced Custom Fields (ACF®) the fix is 5.7.12: builds <= 5.7.11 are affected, anything from 5.7.12 onward is not.

Remediation

Update to version 5.7.12, or a newer patched version

How does WordSec protect against this?

The attempt arrives as an ordinary request to Advanced Custom Fields (ACF®): WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Advanced Custom Fields (ACF®) 5.7.12 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Scanner
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/5eab8a5d-8eb8-495f-a953-b468360cc5d5

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C