exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Redirection 2.7.3 Remote File Inclusion

WordPress Redirection 2.7.3 Remote File Inclusion
Posted Jun 12, 2018
Authored by Glyn Wintle

WordPress Redirection plugin version 2.7.3 suffers from a remote file inclusion vulnerability.

tags | exploit, remote, code execution, file inclusion
SHA-256 | 78aa1bc28075dd91582082ed629d324772fe2f1192d1e98ffcdc49abf6933f2f

WordPress Redirection 2.7.3 Remote File Inclusion

Change Mirror Download
Details
================
Software: Redirection
Version: 2.7.3
Homepage: https://wordpress.org/plugins/redirection/
Advisory report: https://advisories.dxw.com/advisories/ace-file-inclusion-redirection/
CVE: Awaiting assignment
CVSS: 9 (High; AV:N/AC:L/Au:S/C:C/I:C/A:C)

Description
================
ACE via file inclusion in Redirection allows admins to execute any PHP file in the filesystem

Vulnerability
================



If you are logged in as an administrator on any site by using the setup page for the redirection plugin you can run arbitrary code and completely compromise the system.
This is done by writing the URL to redirect to in the format file://path/to/file/here. Unfortunately the plugin executes any PHP within that file. This means that any file with any extension on the filesystem that contains a small amount of user controlled data can be turned into a back door. The plugin also has the functionality to create files and place user controlled data in them. This results in attacker controlled code running and complete compromise of the system.
When the code for handling a redirect looks at the URL to redirect to it does the following:





class Pass_Action extends Red_Action {
function process_before( $code, $target ) {
// Determine what we are passing to: local URL, remote URL, file
if ( substr( $target, 0, 7 ) === \'http://\' || substr( $target, 0, 8 ) === \'https://\' ) {
echo @wp_remote_fopen( $target );
die();
}
else if ( substr( $target, 0, 7 ) === \'file://\' ) {
$parts = explode( \'?\', substr( $target, 7 ) );
if ( count( $parts ) > 1 ) {
// Put parameters into the environment $args = explode( \'&\', $parts[1] );
if ( count( $args ) > 0 ) {
foreach ( $args as $arg ) {
$tmp = explode( \'=\', $arg );
if ( count( $tmp ) === 1 )
$_GET[ $arg ] = \'\';
else
$_GET[ $tmp[0] ] = $tmp[1];
}
}
}

include( $parts[0] );
exit();
}
else {
$_SERVER[\'REQUEST_URI\'] = $target;
if ( strpos( $target, \'?\' ) ) {
$_SERVER[\'QUERY_STRING\'] = substr( $target, strpos( $target, \'?\' ) + 1 );
parse_str( $_SERVER[\'QUERY_STRING\'], $_GET );
}
}

return true;
}
}







The above code behaves as expected if the url to redirect to is a HTTP or HTTPS URL.
If the URL begins with file:// it passes the path to the include function.
Its also worth mentioning that if the URL is not http, https or file, then the code allows the $_GET parameter to be contaminated with unescaped values, which may result in SQL injections.




Proof of concept
================

echo a<?php phpinfo();a > dog-meme.jpg
Visit /wp-admin/media-new.php
Upload dog-meme.jpg
Copy the URL of the file (i.e. http://localhost/wp-content/uploads/2017/10/dog-meme.jpg)
Visit /wp-admin/tools.php?page=redirection.php
Fill aSource URLa with a/testa
Fill aTarget URLa with afile:///var/www/html/wp-content/uploads/2017/10/dog-meme.jpga (this will probably require some modification if your WP installation is at a different path or dog-meme.jpg is saved in a different directory)
Set aGroupa to aRedirectionsa
Press aAdd Redirecta
Press aEdita on the newly added redirect
Press the cog icon
Set aWhen matcheda to aPass-througha
Press aSavea


Mitigations
================
Upgrade to version 2.8 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://advisories.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2017-10-02: Discovered
2017-10-03: Reported via website contact form
2017-10-04: Response received. Plugin author reports this as intended behaviour, as
it is assumed that the administrator has full access to the system. However, also future version will include a fix.

2017-10-18: Author reported fixed in 2.8
2018-06-12: Advisory published



Discovered by dxw:
================
Glyn Wintle
Please visit advisories.dxw.com for more information.




Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close