mcdulltii/cve-2022-1329WordPress Elementor 3.6.0 3.6.1 3.6.2 RCE POC
Google Dork: none
Date: April 16 2022
Exploit Author: AkuCyberSec (https://github.com/AkuCyberSec)
Vendor Homepage: https://elementor.com/
Software Link: https://wordpress.org/plugins/elementor/advanced/ (scroll down to select the version)
Version: 3.6.0, 3.6.1, 3.62
Tested on: WordPress 5.9.3 (os-independent since this exploit does NOT provide the payload)
CVE : CVE-2022-1329
The WordPress plugin called Elementor (v. 3.6.0, 3.6.1, 3.6.2) has a vulnerability that allows any authenticated user to upload and execute any PHP file.
This vulnerability, in the OWASP TOP 10 2021, is placed in position #1 (Broken Access Control)
The file that contains this vulnerability is elementor/core/app/modules/onboarding/module.php
At the end of this file you can find this code:
add_action( 'admin_init', function() {
if ( wp_doing_ajax() &&
isset( $_POST['action'] ) &&
isset( $_POST['_nonce'] ) &&
wp_verify_nonce( $_POST['_nonce'], Ajax::NONCE_KEY )
) {
$this->maybe_handle_ajax();
}
} );
This code is triggered whenever ANY user account visits /wp-admin
In order to work we need the following 4 things:
The file we upload must have the following structure:
This file will be YOUR payload (e.g. PHP Reverse Shell or anything else)
WARNING: The fake plugin we upload will be activated by Elementor, this means that each time we visit any page we trigger our payload.
If it tries, for example, to connect to an offline host, it could lead to a Denial of Service.
In order to prevent this, I suggest you to use some variable to activate the payload.
Something like this (visit anypage.php?activate=1 in order to continue with the actual payload):
if (!isset($_GET['activate']))
return;