WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)

vendor:

Advanced Uploader

by:

Roel van Beurden

8.8

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: Advanced Uploader

Affected Version From: <=4.2

Affected Version To: <=4.2

Patch Exists: YES

Related CWE: CVE-2022-1103

CPE: a:wordpress:advanced_uploader

Metasploit:

Other Scripts:

Platforms Tested: WordPress 5.9 on Ubuntu 18.04

2022

WordPress Plugin Advanced Uploader 4.2 – Arbitrary File Upload (Authenticated)

WordPress Plugin Advanced Uploader <=4.2 allows authenticated arbitrary file upload. Any file(type) can be uploaded. A malicious user can perform remote code execution on the backend webserver.

Mitigation:

Ensure that the Advanced Uploader plugin is up to date and that all users are authenticated before allowing them to upload files.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
# Google Dork: -
# Date: 2022-03-13
# Exploit Author: Roel van Beurden
# Vendor Homepage: -
# Software Link: https://downloads.wordpress.org/plugin/advanced-uploader.4.2.zip
# Version: <=4.2
# Tested on: WordPress 5.9 on Ubuntu 18.04
# CVE: CVE-2022-1103


1. Description:
----------------------
WordPress Plugin Advanced Uploader <=4.2 allows authenticated arbitrary file upload. Any file(type) can be uploaded. A malicious user can perform remote code execution on the backend webserver.


2. Proof of Concept:
----------------------
- Upload file/webshell/backdoor with the Advanced Uploader plugin;
- File is uploaded in the Wordpress Media Library;
- Go to /wp-content/uploads/ where the file is saved;
- Click on the uploaded file for whatever it's supposed to do (RCE, reverse shell).


3. Exploitation demo:
----------------------
https://www.youtube.com/watch?v=Bwpf-IpxtXQ