CVE-2017-20289 Broadstreet CVE debrief

Who should care

Defenders responsible for WordPress installations with the Broadstreet Ad Widget plugin should assess exposure and prioritize patching or mitigation. This includes operators managing WordPress environments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

This vulnerability allows authenticated users to execute attacker-chosen PHP files, potentially leading to code execution and other malicious activities.

• Authenticated users can execute attacker-chosen PHP files
• Directory traversal sequences can be used to include local files
• PHP code execution is possible

Technical summary

The Broadstreet Ad Widget plugin for WordPress contains a local file inclusion vulnerability in versions prior to 2.12.0. This vulnerability allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in the 'step' parameter, optionally with a null byte, to include local files and execute PHP code.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where authenticated user access is possible.

Recommended defensive actions

• Patch the Broadstreet Ad Widget plugin to version 2.12.0 or later
• Restrict access to authenticated users
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was first observed by the Shadowserver Foundation on 2023-10-19. The CVE record and source item provide details about the vulnerability, but evidence of exploitation is limited. Defenders should verify the patch status of WordPress installations with the Broadstreet Ad Widget plugin and review logs for potential exploitation attempts. Limited evidence suggests that attackers may have used directory traversal sequences to include local files and execute PHP code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.