Our Proactive Monitoring Caught a PHP Object Injection Vulnerability in a Another Brand New Plugin

One of the ways we help to improve the security of WordPress plugins, not just for our customers, but for everyone using them, is the proactive monitoring of changes made to plugins in the Plugin Directory to try to catch serious vulnerabilities. That again has lead to us catching a vulnerability of a type that hackers are likely to exploit if they know about it.

This vulnerability is in a brand new plugin, PWAMP, and should have been something that the security review that is supposed to be done before new plugins can be added to the Plugin Directory should have caught. It is something that would have been flagged by our Plugin Security Checker, so it would make sense to run plugins through that during that security review to avoid this type of situation continuing to happen. That it continues to happen speaks to the continued lack of interest in improving security by the leadership of WordPress (starting at the top with Matt Mullenweg) and the continued role we play in limiting the impact of that for everyone else. We would be happy to provide the Plugin Directory team free access to the upload and developer mode capabilities to facilitate that.

The vulnerability occurred in the function after_setup_theme(), located in the file /pwamp.php, where the value of the cookie “pwamp_args” is passed through the unserialize() function, which can lead to PHP object injection:

309	$args = unserialize(stripslashes($_COOKIE['pwamp_args']));

That function will run after the theme is loaded when the device type is set to mobile, which can be done by setting the value of the cookie “pwamp_style” to mobile:

564	add_action( 'after_setup_theme', array($this, 'after_setup_theme') );

After we notified the developer of the issue they released version 1.0.1, which resolves the vulnerability by replacing use of unserialize() with json_decode() (and replaces related use of serialize() with json_encode()):

309	$args = json_decode(stripslashes($_COOKIE['pwamp_args']));

Proof of Concept

With our plugin for testing for PHP object injection installed and activated, set the value of the cookie “pwamp_args” to “O:20:”php_object_injection”:0:{}” and the value of the cookie “pwamp_style” to “mobile”, and then when you visit a frontend page the message “PHP object injection has occurred.” will be shown.