Skip to content

Commit 1ecef26

Browse files
committed
Do a fail_with in case nonce is not found at all
1 parent e2b9225 commit 1ecef26

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

modules/exploits/unix/webapp/wp_ninja_forms_unauthenticated_file_upload.rb

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,12 +106,18 @@ def fetch_ninja_form_nonce
106106
)
107107

108108
unless res && res.code == 200
109-
fail_with Failure::UnexpectedReply, "Unable to access FORM_PATH: #{datastore['FORM_PATH']}"
109+
fail_with(Failure::UnexpectedReply, "Unable to access FORM_PATH: #{datastore['FORM_PATH']}")
110110
end
111111

112112
form_wpnonce = res.get_hidden_inputs.first['_wpnonce']
113113

114-
res.body[/var nfFrontEnd = \{"ajaxNonce":"([a-zA-Z0-9]+)"/i, 1] || form_wpnonce
114+
nonce = res.body[/var nfFrontEnd = \{"ajaxNonce":"([a-zA-Z0-9]+)"/i, 1] || form_wpnonce
115+
116+
unless nonce
117+
fail_with(Failure::Unknown, 'Cannot find wpnonce or ajaxNonce from FORM_PATH')
118+
end
119+
120+
nonce
115121
end
116122

117123
def upload_payload(data)

0 commit comments

Comments
 (0)