file /wp-content/plugins/updraftplus/admin.php line 1843 function plupload_action
via the name parameter to set filename, and move file content into this file.
The server will do a basic verification of the file name, you can get a valid backup file name,just like backup_2017-11-29-1844_test_d6c634e49869-plugins.zip.
after the 39 lines, this file be delete
there are Race condition, when we view this pages before delete after write in. we can make php code execution.
PoC
file name just like:
1
backup_2017-11-29-1844_test_d6c634e49869-plugins
file content:
1
2
3
4
<?php
$f = fopen('../a.php','wb');
fwrite($f, '<?php phpinfo();?>');
fclose($f);
via upload this file, and view this pages before delete, we can write a a.php into /wp-content/a.php
（2017.11.29 Supplement Vulnerability Details）
authentiicated ssrf
file /wp-content/plugins/updraftplus/admin.php line 1233 function updraft_ajax_handler
when subaction='httpget'the curl parameter follow into function http_get,
they will use curl to request url, it can be exploited to conduct server-side request forgery (SSRF) attacks.
@LoRexxar If somebody can log in as a WP administrator, then they donot need to carry out complicated "attacks" against upload race conditions that only they have access to. Instead, they can just doanyof10,000 other things to manipulate your filesystem, e.g.
Install a WP file manager pluginand manipulate the filesystem at will
Install their own malicious pluginor theme directly using the WP plugin uploader
Upload a malicious backupof their own creationandrestore it
Download an existing backup, edit it, upload it andrestore it
Use the in-built WordPress code or theme editor to edit existing parts of WordPress
For something to be an attack, it has to give a user powers that they did not already have. A procedure that allows them, through a very complicated work-around method, todo something that they could already dothrough many other mechanisms isnot an attack. Admins can already do the same thing in zillions of other ways. UpdraftPlus is a backup/restoreplugin! An evil admin can just create a malicious backup, andthenrestore it.... he doesn't need to do something really convoluted as an alternative.
没有评论:
发表评论