CVE-2023-4724 | CVE-2023-5882

It is no mystery now that in Unlock Security we are big fans of SemGrep for doing code reviews. We often use it to write precise rules to automatically unearth complex patterns in code, following the flow of data from user input to potentially unsafe uses.

To do testing we usually use WordPress plugins because there are so many of them (90,000+) and because they are written by all possible types of programmers: individual novices, professionals, companies, ... each with their own way of writing code. Writing a good rule for SemGrep that gives neither too many false positives nor too many false negatives in this scenario is quite a feat, but it can lead to very satisfactory results.

During testing for the rule finding code injection type vulnerabilities, we experienced a match:

┌─────────────────┐
│ 3 Code Findings │
└─────────────────┘

    ./wp-content/plugins/wp-all-export/actions/wp_ajax_wpae_preview.php 
       php.wordpress-plugins.security.wp-sec-code-injection                                                                                    
          Detected user input used as code or callback to execute. This is usually bad practice        
          because it could accidentally result in Remote Command Execution (RCE). An attacker could    
          use it to takeover the entire website.

          125┆ $exportQuery = eval('return new WP_User_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'number' => 10));');
            ⋮┆----------------------------------------
          128┆ $exportQuery = eval('return new WP_Comment_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'number' => 10));');
            ⋮┆----------------------------------------
          135┆ $exportQuery = eval('return new WP_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'posts_per_page' => 10));');

Looking at these three snippets, it is clear that if we have a way to reach any of the reported lines of code and we have control over the value of $exportOptions['wp_query'], then we can execute arbitrary PHP code. Below is a simplified excerpt of the vulnerable code:

actions/wp_ajax_wpae_preview.php
<?php
/**
*	AJAX action for preview export row
*/

function pmxe_wp_ajax_wpae_preview(){

	if ( ! check_ajax_referer( 'wp_all_export_secure', 'security', false )){
		exit( json_encode(array('html' => __('Security check', 'wp_all_export_plugin'))) );
	}

	if ( ! current_user_can( PMXE_Plugin::$capabilities ) ){
		exit( json_encode(array('html' => __('Security check', 'wp_all_export_plugin'))) );
	}

	// …

	$values = array();

	parse_str($_POST['data'], $values);

	if(is_array($values['cc_options'])) {
		// …
	}

	// …

	$exportOptions = $values + (PMXE_Plugin::$session->has_session() ? PMXE_Plugin::$session->get_clear_session_data() : array()) + PMXE_Plugin::get_default_import_options();

	// …

	if ( 'advanced' == $exportOptions['export_type'] )
	{
		if ( XmlExportEngine::$is_user_export ) {
			$exportQuery = eval('return new WP_User_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'number' => 10));');
		}
		elseif ( XmlExportEngine::$is_comment_export ) {
			$exportQuery = eval('return new WP_Comment_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'number' => 10));');
		}
		else {
			// …
			$exportQuery = eval('return new WP_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'posts_per_page' => 10));');
		}
	}
	// …

The flow of data from the user input(source) to the vulnerable function(sink) can be summarized as follows:

/* $_POST['data'] string is parsed as an array into $values */
parse_str($_POST['data'], $values);

/* $values is added into $exportOptions */
$exportOptions = $values + // …

/* $exportOptions['export_type'] must be 'advanced' to reach the vulnerable code */
if ( 'advanced' == $exportOptions['export_type'] )
{
    /* We don't care of all the if clause since we have the same code in all of them and in the else clause too */
	$exportQuery = eval('return new WP_Query(array(' . $exportOptions['wp_query'] . ', 'offset' => 0, 'posts_per_page' => 10));');

The vulnerable code is located within the function pmxe_wp_ajax_wpae_preview in the folder actions/. Searching throughout the plugin code for the invocation of this function, there are no matches. Upon closer inspection, it can be seen that this function is registered as a WordPress AJAX action based on the name of the PHP file containing it; and this process is repeated for all PHP files in the same folder:

wp-all-export.php
// register action handlers
if (is_dir(self::ROOT_DIR . '/actions')) if (is_dir(self::ROOT_DIR . '/actions')) foreach (PMXE_Helper::safe_glob(self::ROOT_DIR . '/actions/*.php', PMXE_Helper::GLOB_RECURSE | PMXE_Helper::GLOB_PATH) as $filePath) {
    require_once $filePath;
    $function = $actionName = basename($filePath, '.php');
    if (preg_match('%^(.+?)[_-](\d+)$%', $actionName, $m)) {
        $actionName = $m[1];
        $priority = intval($m[2]);
    } else {
        $priority = 10;
    }
    add_action($actionName, self::PREFIX . str_replace('-', '_', $function), $priority, 99); // since we don't know at this point how many parameters each plugin expects, we make sure they will be provided with all of them (it's unlikely any developer will specify more than 99 parameters in a function)
}

This means that in our case an authenticated AJAX action (prefix wp_ajax_) called wpae_preview will be registered that will invoke the vulnerable function pmxe_wp_ajax_wpae_preview.

We already know that we need to be authenticated to use this AJAX action, but what is the minimum role that our user must have? Are there any other prerequisites? The answer to these questions comes from the first lines of the vulnerable function:

actions/wp_ajax_wpae_preview.php
function pmxe_wp_ajax_wpae_preview(){

	if ( ! check_ajax_referer( 'wp_all_export_secure', 'security', false )){
		exit( json_encode(array('html' => __('Security check', 'wp_all_export_plugin'))) );
	}

	if ( ! current_user_can( PMXE_Plugin::$capabilities ) ){
		exit( json_encode(array('html' => __('Security check', 'wp_all_export_plugin'))) );
	}

We first need our user to have the capability specified in PMXE_Plugin::$capabilities which corresponds to manage_options. This capability indicates the ability for a user to access and manage WordPress settings, so only the administrator user has it.