Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

criticalseverity

9.8CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE.

Impact

Unauthenticated attackers can exploit missing signature validation to upload arbitrary files and achieve remote code execution on WordPress installations running vulnerable Form-Maker plugins.

Fix

Fixed in 1.15.20

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/form-maker/readme.txt
Positive when: status_code == 200 and compare_versions(version, '< 1.15.20') and contains(body, 'Form Maker by 10Web')

Run it with nuclei: nuclei -id CVE-2023-4666 -u <target>

The full check

id: CVE-2023-4666

info:
  name: Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
  author: pussycat0x
  severity: critical
  description: |
    The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE.
  impact: |
    Unauthenticated attackers can exploit missing signature validation to upload arbitrary files and achieve remote code execution on WordPress installations running vulnerable Form-Maker plugins.
  remediation: Fixed in 1.15.20
  reference:
    - https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-4666
    epss-score: 0.03781
    epss-percentile: 0.90043
    cpe: cpe:2.3:a:10web:form_maker:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    fofa-query: 'body="/wp-content/plugins/form-maker/"'
    max-request: 1
    vendor: 10web
    product: form_maker
    framework: wordpress
  tags: wpscan,cve,cve2023,wordpress,wp-plugin,form-maker,passive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/form-maker/readme.txt"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "compare_versions(version, '< 1.15.20')"
          - "contains(body, 'Form Maker by 10Web')"
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

References

https://wpscan.com/vulnerability/c6597e36-02d6-46b4-89db-52c160f418be/

Use this check only on systems you are authorised to test. Where the data comes from