Adning Advertising <= 1.5.5 - Arbitrary File Upload

criticalseverity

9.8CVSS score

6.9%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.

Impact

Unauthenticated attackers can upload malicious files to achieve remote code execution, potentially compromising the entire WordPress site and server.

Fix

Fixed in 1.5.6

How to confirm it

Send: GET {{BaseURL}}/
Positive when: status_code == 200 and contains_all(body, 'served by Adning','adning.com') and compare_versions(version, '< 1.5.6')

Run it with nuclei: nuclei -id CVE-2020-36705 -u <target>

The full check

id: CVE-2020-36705

info:
  name: Adning Advertising <= 1.5.5 - Arbitrary File Upload
  author: DhiyaneshDK
  severity: critical
  description: |
    The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the _ning_upload_image function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected sites server which may make remote code execution possible.
  impact: |
    Unauthenticated attackers can upload malicious files to achieve remote code execution, potentially compromising the entire WordPress site and server.
  remediation: Fixed in 1.5.6
  reference:
    - https://blog.nintechnet.com/critical-vulnerability-in-adning-advertising-plugin-actively-exploited-in-the-wild/
    - https://codecanyon.net/item/wp-pro-advertising-system-all-in-one-ad-manager/269693
    - https://wpscan.com/vulnerability/e9873fe3-fc06-4a52-aa32-6922cab7830c
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a263b74-e9ae-4fd2-be9b-9b8e9eee5982?source=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-36705
    epss-score: 0.06888
    epss-percentile: 0.94122
    cpe: cpe:2.3:a:tunasite:adning_advertising:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/angwp"
    vendor: tunasite
    product: adning_advertising
    framework: wordpress
  tags: cve,cve2020,wordpress,wp-plugin,angwp,wp,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    host-redirects: true
    max-redirects: 2

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?i)Ads on this site are served by Adning v([0-9.]+)"
        internal: true

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, 'served by Adning','adning.com')
          - compare_versions(version, '< 1.5.6')
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from