Advanced Database Cleaner Vulnerability – Authenticated(Administrator+) PHP Object Injection via process_bulk_action – CVE-2024-0668 | WordPress Plugin Vulnerability Report

Q: What exactly is the vulnerability in Advanced Database Cleaner?

What exactly is the vulnerability in Advanced Database Cleaner? The vulnerability allows authenticated users with admin access to inject arbitrary PHP objects due to the improper handling of user input. Specifically, the 'process_bulk_action' function deserializes untrusted data without proper sanitization. This could enable serious impacts if a POP chain exists via other plugins.

Q: What versions of Advanced Database Cleaner are affected?

What versions of Advanced Database Cleaner are affected? All versions up to and including 3.1.3 are affected. The vulnerability has been patched in version 3.1.4, released on January 24, 2024.

Q: What is the risk if my site is vulnerable?

What is the risk if my site is vulnerable? If exploited, this vulnerability could allow attackers to delete files, steal sensitive database information, or even execute remote code on your site. The impacts depend on if a POP chain exists, but it should be treated as a critical risk.

Q: How can I tell if my site has already been compromised?

How can I tell if my site has already been compromised? Carefully check logs for any suspicious activity. Also scan your site with a malware/virus detection tool to identify any compromised files or code. Watch for unexpected behavior like plugin settings changing.

Q: Should I remove Advanced Database Cleaner from my site?

Should I remove Advanced Database Cleaner from my site? Not necessarily - the developers have patched the issue quickly. Upgrading to the latest secure version is recommended. However, consider installing an alternate database cleanup plugin as an extra precaution.

Q: What if I can't update the plugin right away?

What if I can't update the plugin right away? Restrict admin access to trusted users only until you can update. Also consider setting up a web application firewall to help block potential attacks leveraging this specific vulnerability.

Q: Could updating cause any issues with my site?

Could updating cause any issues with my site? Updating to a new version should not cause issues in most cases. However, it's wise to backup your site before updating just in case. Also test the updated plugin on a staging site if possible.

Q: What can I do to prevent future vulnerabilities?

What can I do to prevent future vulnerabilities? Enabling automatic background updates for both WordPress core and any plugins is a great step. Also research the security and update frequency of plugins before installing them.

Q: Should I be concerned about other plugins having vulnerabilities?

Should I be concerned about other plugins having vulnerabilities? Yes - vulnerabilities in popular WordPress plugins are unfortunately quite common. It's critical to keep all plugins updated and have a process to promptly patch security issues.

Q: Who discovered and reported this vulnerability?

Who discovered and reported this vulnerability? This vulnerability was discovered and responsibly disclosed by researcher Richard Telleng on January 24, 2024 to allow developers time to patch it before public release.

By Your WP Guy | January 24, 2024

Plugin Name: Advanced Database Cleaner

Key Information:

Software Type: Plugin
Software Slug: advanced-database-cleaner
Software Status: Active
Software Author: symptote
Software Downloads: 1,283,477
Active Installs: 100,000
Last Updated: January 24, 2024
Patched Versions: 3.1.4
Affected Versions: <= 3.1.3

Vulnerability Details:

Name: Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action
Title: Authenticated(Administrator+) PHP Object Injection via process_bulk_action
Type: Deserialization of Untrusted Data
CVE: CVE-2024-0668
CVSS Score: 6.6 (Medium)
Publicly Published: January 24, 2024
Researcher: Richard Telleng
Description: The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'process_bulk_action' function. This makes it possible for authenticated attacker, with administrator access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Summary:

The Advanced Database Cleaner for WordPress has a vulnerability in versions up to and including 3.1.3 that allows authenticated users with admin access to inject PHP objects. This could lead to sensitive data exposure, arbitrary file deletion, or remote code execution if a POP chain is present. This vulnerability has been patched in version 3.1.4.

Detailed Overview:

Researcher Richard Telleng disclosed that the Advanced Database Cleaner plugin is vulnerable to PHP object injection due to the deserialization of untrusted input in the 'process_bulk_action' function. This makes it possible for an attacker with admin access to inject arbitrary PHP objects. While no POP chain is present in the vulnerable plugin itself, the presence of a POP chain in other installed plugins or themes could enable serious impacts like arbitrary code execution, sensitive data theft or destruction of files.

Advice for Users:

Immediate Action: Update to version 3.1.4 as soon as possible.
Check for Signs of Compromise: Review logs and scan with a malware detection tool to identify any indicators of compromise from this vulnerability.
Alternate Plugins: Consider alternate database cleanup plugins like WP-Optimize as a precaution.
Stay Updated: Enable auto-updates on plugins to receive security fixes as they become available.

Conclusion:

Symptote's quick release of Advanced Database Cleaner version 3.1.4 patched this medium severity vulnerability. Users should update immediately to avoid potential compromise. As always keeping plugins updated is key to securing WordPress sites.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-database-cleaner

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/advanced-database-cleaner/advanced-database-cleaner-313-authenticatedadministrator-php-object-injection-via-process-bulk-action

Detailed Report:

Website security should be a top concern for any online business. Unfortunately, vulnerabilities in widely-used plugins put countless sites at risk every day. Case in point: a serious flaw was recently disclosed in Advanced Database Cleaner, a plugin installed on over 100,000 WordPress sites. This vulnerability allows attackers to remotely execute malicious code on vulnerable websites. Left unpatched, your site could easily be compromised, destroyed, or used to attack others.

Advanced Database Cleaner is a popular plugin used to clean up redundant and outdated data in WordPress databases. It has over 1.2 million downloads and around 100,000 active installs. On January 24th, researcher Richard Telleng disclosed a vulnerability that impacts all versions up to and including 3.1.3.

This vulnerability allows authenticated users with admin access to inject arbitrary PHP objects due to the deserialization of untrusted input. While no POP chain for remote code execution is present in the plugin itself, the vulnerability could enable serious impacts if a POP chain exists via other installed plugins or the theme. Attackers could destroy files, steal sensitive data, or run malicious code on vulnerable sites.

To protect your website, it's critical to update Advanced Database Cleaner to version 3.1.4 as soon as possible. This release patches the vulnerability by sanitizing inputs before deserializing data. Check your site for any signs of compromise and consider installing an alternative database cleanup plugin as a precaution.

Unfortunately, this is not the first vulnerability found in Advanced Database Cleaner. There have been 5 other flaws disclosed since September 2020, illustrating the importance of prompt security updates. New threats emerge constantly, so running outdated software makes you an easy target. Don’t fall victim when fixes exist!

We care about the web and want to help site owners secure their online presence. If you use Advanced Database Cleaner or simply want a professional opinion about your site’s protection, contact us. Our team can audit your plugins, scan for threats, and help apply patches. A small investment now could save you from disaster down the road. The key is being proactive about security upkeep. Your site’s security depends on it!

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.