ANALYSIS · ccfee424· FINISHED 2026-06-13 · PATCHDIFF

backup-backup1.3.7 → 1.3.8✓ COMPLETED

Files3

Vulnerable2

True positives0

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2023-6553

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 3 CVE 1 Vuln 2

SORT

1 files · page 1/1

includes/backup-heart.php

AI: 1 vulnerabilities

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CVE-2023-6553

#%!d(float64=003)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2023-6553

Security writeup for CVE-2023-6553

✓ 1 FILE

## The Exploit

An unauthenticated attacker can execute arbitrary PHP code by sending a specially crafted HTTP request with malicious values in the `content-abs` and `content-dir` header fields, which are then passed unsanitized to `define()` and `require_once()` statements.

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded

action=bmi_heart_beat&content-abs=php://filter/convert.base64-encode/resource=/etc/passwd&content-dir=/var/www&content-configdir=/var/www&content-content=/var/www&content-backups=/var/www
```

The server parses these fields directly from the POST body into the `$fields` array without validation, then uses them to redefine `ABSPATH` and include critical plugin files. An attacker observing the response will see error messages leaking filesystem paths, or in optimized attacks, will see the PHP filter chain executed — for example, base64-encoded copies of sensitive files reflected in error logs or debug output. When `require_once` is called with a filter-wrapped path, the injected filter runs before the file inclusion logic, allowing the attacker to read arbitrary files or, in chained variants, execute code.

## What the Patch Did

**Before**
```php
define('ABSPATH', $fields['content-abs']);
define('BMI_ROOT_DIR', $fields['content-dir']);
require_once BMI_INCLUDES . '/bypasser.php';
$request = new BMI_Backup_Heart(true,
  $fields['content-configdir'],
  $fields['content-content'],
  $fields['content-backups'],
  $fields['content-abs'],
  $fields['content-dir'],
```

**After**
```php
define('ABSPATH', filterChainFix($fields['content-abs']));
define('BMI_ROOT_DIR', filterChainFix($fields['content-dir']));
require_once filterChainFix(BMI_INCLUDES) . '/bypasser.php';
$request = new BMI_Backup_Heart(true,
  $fields['content-configdir'],
  $fields['content-content'],
  $fields['content-backups'],
  filterChainFix($fields['content-abs']),
  filterChainFix($fields['content-dir']),
```

The patch introduced a custom validation function `filterChainFix()` that wraps every user-controlled input before it reaches a security-critical operation. This function implements multi-layered input filtering: it validates that the input is a string, enforces a maximum length of 256 characters (blocking PHP filter chains which are verbose), rejects any path containing the `php:` protocol prefix or pipe character (`|`, used to chain filters), and finally verifies that the resulting path actually exists on the filesystem using `is_dir()` or `file_exists()`. Together, these checks prevent PHP stream filter injection by making it impossible to pass filter URLs to `define()` or `require_once()`.

## Root Cause

**CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component—'Injection')** combined with **CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)**.

The `backup-heart.php` file processes the AJAX action `bmi_heart_beat`, extracting user input from POST parameters (`content-abs`, `content-dir`, `content-configdir`, `content-content`, `content-backups`) into an associative array `$fields` without any prior sanitization. This input then flows directly into two dangerous sinks: the `define()` function (which sets PHP constants to arbitrary string values) and the `require_once()` statement (which loads PHP files). PHP's stream wrapper functionality means that a string like `php://filter/convert.base64-encode/resource=/etc/passwd` is a valid file path in these contexts, and the PHP engine will execute the filter chain before attempting file operations. The vulnerability exists because there is no whitelist, type check, or protocol validation between the request boundary and the sink — the attacker's controlled value travels the entire dataflow unchecked.

## Why It Works

The load-bearing line is the blocklist check for `php:` and `|` characters inside `filterChainFix()`. Without it, an attacker bypasses all other checks: the length limit can be circumvented by chaining multiple smaller payloads, and filesystem existence checks fail when the attacker hasn't created the malicious file locally. The pipe character is essential because PHP filters are chained with the syntax `php://filter/convert.X|convert.Y/resource=...`, so rejecting `|` alone breaks the injection syntax. The length limit (256 characters) and type check (`is_string()`) are defense-in-depth: they catch obvious attacks early and prevent type juggling bypass tricks. The filesystem existence validation (`is_dir()` / `file_exists()`) ensures that only paths to real resources can be dereferenced, preventing attackers from inventing arbitrary paths wholesale. If the engineer had omitted only the `php:` and `|` blocklist, the exploit would still work; if they had omitted only the length limit, an attacker could still build a working filter chain; but together, these layers force an attacker to provide a real filesystem path with no protocol prefix and no filter syntax — turning the injection primitive into a harmless path disclosure.

## Hardening Checklist

- **Use `wp_safe_remote_post()` with strict `sslverify` and timeout parameters** for any inter-plugin or cross-origin communication; avoid custom header parsing without using WordPress HTTP APIs that apply baseline validation.
- **Apply `sanitize_file_name()` or `sanitize_text_field()` to any user input before passing it to `define()`, `require()`, `include()`, or `file_get_contents()`**; never pass raw `$_POST` or `$_GET` values directly to these functions.
- **Validate file paths against a whitelist of allowed directories using `realpath()` and checking that the resolved path is within an expected prefix**; for example, `if (strpos(realpath($user_path), realpath(WP_CONTENT_DIR)) !== 0) { wp_die('Invalid path'); }`.
- **Reject any input containing protocol schemes (`://`) or dangerous characters (`|`, `;`, `$`, backticks) using a regex or blocklist before file operations**; PHP stream wrappers are a common attack surface in file-handling plugins.
- **Test file inclusion paths with `wp_cache_get_multiple()` or similar caching to avoid repeated filesystem access**, and log all file operations to catch injection attempts in the audit trail.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-6553

CVE CVE-2023-6553

PRODUCT backup-backup

AFFECTED ≤ 1.3.7

FIXED IN 1.3.8

STATUS Generated

Security writeup · CVE-2023-6553

Source files · 1

includes/backup-heart.php Linked

↗ NVD