GoKawiilTechnical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform’s Core component.
The security problem does not have an official identifier but was addressed last week with the release of WordPress version 7.1.1.
It is a pre-authenticated remote code execution chain that allows an attacker to install any theme in the official WordPress.org catalog and run an arbitrary PHP file.
Security researcher Paulos Yibelo of the autonomous penetration testing platform pwn.ai discovered Click2Shell and reported it to WordPress on August 22.
The researchers explain that "a value from a WordPress theme-preview URL is interpreted once by the WordPress.org Themes API and a second, buggy methods by JavaScript in the Administrator's browser."
This enables an attacker to add a WordPress theme to a target website without the administrator explicitly installing it. The researcher found that even if inactive, a theme could still execute PHP during a Customizer preview.
It should be noted that even if the attacker does not need to authenticate, a logged-in administrator needs to visit a crafted URL for the Click2Shell exploit to work.
An attack could start with a crafted link that leads to installing a vulnerable theme in the catalog. Once the Customizer preview loads the inactive theme's PHP, the code is executed on the server.
To demonstrate the issue, pwn.ai used a vulnerable WordPress theme as the second component in the chain that executed the attacker's PHP code.
The researcher's full technical report provides a complete proof-of-concept (PoC) exploit for achieving server-side remote code execution.
... continue reading