CVE-2020-20919
📋 TL;DR
This vulnerability allows remote attackers to upload malicious files through the theme.php file in Pluck CMS, potentially leading to arbitrary code execution and sensitive information disclosure. It affects Pluck CMS v.4.7.10-dev2 installations. Attackers can exploit this without authentication to compromise the web server.
💻 Affected Systems
- Pluck CMS
📦 What is this software?
Pluck by Pluck Cms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, data theft, and potential lateral movement within the network.
Likely Case
Webshell deployment leading to website defacement, data exfiltration, and server compromise.
If Mitigated
File upload attempts blocked or logged with no successful exploitation.
🎯 Exploit Status
The vulnerability is in a development version, but exploitation is straightforward once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Later versions (avoid v.4.7.10-dev2)
Vendor Advisory: https://github.com/pluck-cms/pluck/issues/85
Restart Required: No
Instructions:
1. Upgrade to a stable release of Pluck CMS. 2. Remove or replace the vulnerable theme.php file. 3. Verify no malicious files were uploaded.
🔧 Temporary Workarounds
Restrict file uploads
allImplement strict file type validation and upload restrictions
Disable theme.php access
linuxBlock access to the vulnerable theme.php file via web server configuration
# Apache: <Location /theme.php> Require all denied </Location>
# Nginx: location = /theme.php { deny all; }
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file upload exploits
- Monitor file upload directories for suspicious files and restrict write permissions
🔍 How to Verify
Check if Vulnerable:
Check if running Pluck CMS v.4.7.10-dev2 by examining version files or admin panelCheck Version:
Check Pluck CMS version in admin panel or version.txt fileVerify Fix Applied:
Verify upgraded to non-vulnerable version and test file upload functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to theme.php
- POST requests to theme.php with file parameters
- Webshell creation in upload directories
Network Indicators:
- HTTP POST requests to theme.php endpoint
- File upload patterns to unexpected locations
SIEM Query:
source="web_logs" AND uri="/theme.php" AND method="POST" AND (file_upload OR multipart)