JupiterX Theme <= 2.0.6 and Jupiter Theme <= 6.10.1 - Authenticated Path Traversal and Local File Inclusion
Strategic Overview
- Status
- Patched in 6.10.2
- Affected Theme
- Jupiter
- Affected Version
<= 6.10.1- CVSS
- 8.1High
- Weakness type
- CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
- CVE
CVE-2022-1657
At a glance
CVE-2022-1657 is a high-severity Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in the Jupiter WordPress theme, affecting versions <= 6.10.1. It carries a CVSS score of 8.1 (reachable over the network; low attack complexity; high confidentiality, integrity impact). Exploitation requires an authenticated account. The issue is fixed in version 6.10.2; sites on affected versions should update now. Disclosed May 2022, reported by Ram.
Vulnerability Overview
Vulnerable versions of the Jupiter and JupiterX Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Reaching this weakness in Jupiter <= 6.10.1 takes any authenticated account. PHP file inclusion means a path used by include or require is built from request data, so the file that gets executed is under the caller's influence.
Including an attacker-influenced file executes its contents, which is why this class is routinely chained with an upload or log-poisoning step to reach code execution. For Jupiter the fix is 6.10.2: builds <= 6.10.1 are affected, anything from 6.10.2 onward is not.
Remediation
Update to version 6.10.2, or a newer patched version
How does WordSec protect against this?
The attempt arrives as an ordinary request to Jupiter: WordSec's web application firewall inspects request payloads before WordPress loads them. Classes like this one can leave something behind, so the staged malware scanner is the second half: it looks for dropped files and modified code rather than for the request that created them. None of that substitutes for the fix: Jupiter 6.10.2 closes this, and updating the theme is the step that ends it.
- Firewall
- Scanner
- Alerts
External References
Related records
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C