Application Insights Dashboard Plugin - Insecure deserialization

Summary

Name	Application Insights Dashboard Plugin 2.0a - Insecure deserialization
Code name	skims-0023
Product	Application Insights Dashboard Plugin
Affected versions	Version 2.0a
State	Private
Release date	2025-03-14

Vulnerability

Kind	Insecure deserialization
Rule	Insecure deserialization
Remote	No
CVSSv4 Vector	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U
CVSSv4 Base Score	1.7 (Low)
Exploit available	No
CVE ID(s)	CVE-2025-31300

Description

Application Insights Dashboard Plugin 2.0a was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/admin/appinsights-settings.php.

Vulnerability

Skims by Fluid Attacks discovered a Insecure deserialization in Application Insights Dashboard Plugin 2.0a. The following is the output of the tool:

Skims output

 3 | private static function set_get_options($reset = false) {
 4 | global $AppInsights_Config;
 5 |
 6 | $options = $AppInsights_Config->options;
 7 |
 8 | if (isset($_POST['options']['appinsights_hidden'])
 9 | && isset($_POST['options'])
 10 | && (isset($_POST['appinsights_security'])
 11 | && wp_verify_nonce($_POST['appinsights_security'], 'appinsights_form' )
 12 | && !$reset)) {
 13 | if ($_POST ['options']['appinsights_component_list'] && is_string($_POST ['options']['appinsights_component_list'])) {
> 14 | $_POST ['options']['appinsights_component_list'] = unserialize(stripslashes($_POST ['options']['appinsights_component
 15 | }
 16 |
 17 | $new_options = $_POST ['options'];
 18 | $options = array_merge($options, $new_options);
 19 | $AppInsights_Config->options = $options;
 20 | $AppInsights_Config->set_plugin_options();
  21 |   }
  22 |
  23 |   return $options;
  24 |  }
     ^ Col 0

Our security policy

We have reserved the ID CVE-2025-31300 to refer to this issue from now on.

• https://fluidattacks.com/advisories/policy/

System Information

• Product: Application Insights Dashboard Plugin
• Version: 2.0a

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andres Roldan from Fluid Attacks' Offensive Team using Skims

Timeline