BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter

This research plan outlines the technical steps required to exploit CVE-2025-13681, a Path Traversal vulnerability in the BFG Tools – Extension Zipper plugin.

1. Vulnerability Summary

The BFG Tools – Extension Zipper plugin (version <= 1.0.7) contains an authenticated path traversal vulnerability within its zip() function. The function accepts a user-supplied parameter first_file which is used to define the file or directory to be included in a ZIP archive. Because the plugin fails to properly sanitize this input (e.g., via realpath() validation or restricting the path to the intended directory), an Administrator can provide traversal sequences (like ../../) to include sensitive files from the server's root, such as wp-config.php, in the generated ZIP.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php (inferred, as zipping is typically an asynchronous admin task).
• Action: Likely bfg_tools_extension_zipper_zip or similar (inferred from plugin slug).
• Vulnerable Parameter: first_file.
• Authentication: Required (Administrator+).
• Preconditions: The plugin must be active. The attacker must have a valid session cookie for an Administrator user.

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX handler for zipping files, likely using add_action( 'wp_ajax_...', '...zip' ).
2. Input Collection: The handler retrieves the first_file parameter from the $_POST or $_GET request.
3. Path Construction: The code likely prepends a base path (e.g., WP_PLUGIN_DIR) to the first_file input.
4. Vulnerable Sink: The constructed path is passed to a ZIP library (like ZipArchive) without checking if the resolved path remains within the intended directory.
5. Output: The plugin generates a ZIP file and either provides a download link or direct output.

4. Nonce Acquisition Strategy

Since this is an administrative action, it is highly likely protected by a WordPress nonce.

1. Identify Admin Page: Navigate to the plugin's settings/tools page. The slug is likely bfg-tools-extension-zipper.
2. Locate Nonce: Use browser_eval to search for nonces in the global JavaScript scope or localized script objects.
   • Look for a variable like bfg_tools_vars or bfg_zip_nonce.
   • Search the HTML source for name="_wpnonce" or id="...nonce...".
3. Extraction:

   // Example target if localized
   window.bfg_tools_settings?.nonce 
   // Or if in a form
   document.querySelector('input[name="_wpnonce"]')?.value
   

5. Exploitation Strategy

The goal is to zip and download wp-config.php.

Step 1: Authentication
Log in to the WordPress dashboard as an administrator.

Step 2: Nonce & Endpoint Discovery
Navigate to the BFG Tools interface (usually under "Tools" or its own menu). Identify the AJAX action by inspecting the "Zip" button's event listeners or the network tab during a legitimate zip operation.

Step 3: Crafting the Traversal Payload

• Target File: wp-config.php (usually located 3 levels up from the plugins directory).
• Payload: ../../../../wp-config.php.

Step 4: Execute HTTP Request
Using the http_request tool, send a POST request to admin-ajax.php:

{
  "method": "POST",
  "url": "http://localhost:8080/wp-admin/admin-ajax.php",
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  "body": "action=bfg_tools_extension_zipper_zip&first_file=../../../../wp-config.php&_wpnonce=[NONCE_EXTRACTED_ABOVE]"
}

6. Test Data Setup

1. Plugin Installation: Install and activate bfg-tools-extension-zipper version 1.0.7.
2. Admin User: Ensure an admin user exists (e.g., admin/password).
3. Environment Check: Ensure the standard wp-config.php exists in the WordPress root.

7. Expected Results

• Success: The server responds with a 200 OK and either:
  • A link to a generated .zip file in the /wp-content/uploads/ directory.
  • A JSON response containing a success message and a file path.
• Payload Verification: Downloading and extracting the generated ZIP will reveal the wp-config.php file containing database credentials (DB_PASSWORD, DB_USER).

8. Verification Steps

After the HTTP request, verify the existence of the leaked data:

1. Check Uploads: Use ls -R /var/www/html/wp-content/uploads/ via terminal or WP-CLI to find the newly created ZIP file.
2. Inspect ZIP Content:

   unzip -l /path/to/generated/file.zip
   

   Confirm that wp-config.php is listed in the archive.

9. Alternative Approaches

• Directory Traversal: If first_file expects a directory, try zipping the entire root: ../../../../.
• Direct File Access: If the plugin doesn't use ZIP but simply reads the file path to display info, the first_file parameter might be used in a file_get_contents sink, leading to direct disclosure in the response body.
• Varying Path Depths: If ../../../../wp-config.php fails, try different depths (e.g., ../../../wp-config.php) depending on the exact plugin directory structure.