CVE-2022-2437 Feed Them Social – for Twitter feed, Youtube and more <= 2.9.8.5 - Unauthenticated PHAR Deserialization
Unauthenticated attackers can achieve arbitrary code execution via PHAR deserialization in the Feed Them Social WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-2437?
CVE-2022-2437 is a critical unsafe deserialization vulnerability in slickremix Feed Them Social – Social Media Feeds, Video, and Photo Galleries, published on 18 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter in versions up to, and including 2.9.8.5. This makes it possible for unauthenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Weakness: CWE-502
Which versions are affected by CVE-2022-2437?
It affects 1 product.
Products include Slickremix Feed Them Social.
How do I fix CVE-2022-2437?
No fix has been published for CVE-2022-2437 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-2437 being exploited?
There is no known exploitation of CVE-2022-2437 in the wild and no public exploit code.
Other vulnerabilities in slickremix Feed Them Social – Social Media Feeds, Video, and Photo Galleries
- CVE-2015-9351 Code injection in n/a
- CVE-2022-2383 Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting
- CVE-2022-2532 Feed Them Social < 3.0.1 - Reflected Cross-Site Scripting
- CVE-2015-9350 Cross-site scripting in n/a
- CVE-2020-36739 Feed Them Social – Page, Post, Video, and Photo Galleries <= 2.8.6 - Cross-Site Request Forgery Bypass
Sources
Also known as GHSA-wxr3-9j23-3f82.