WordPress Patches ‘Click2Shell’ Vulnerability
WordPress 7.1.1 patches Click2Shell, a theme-preview flaw that can lead to remote code execution.
WordPress 7.1.1 fixes 11 vulnerabilities, including Click2Shell, which does not yet have a CVE identifier. pwn.ai said a crafted theme-preview URL is interpreted differently by the themes API and by JavaScript in an administrator’s browser, so an unauthenticated attacker can install a chosen WordPress.org theme without consent. More than 40 third-party themes execute PHP while inactive during Customizer preview, and one visit by a logged-in administrator can lead to code execution under the WordPress server account. Fixes were backported through WordPress 4.7, pwn.ai received a $300 bounty, and it published a proof of concept.
- Click2Shell has no CVE; pwn.ai published details and proof-of-concept code.
- A crafted URL can silently install an attacker-chosen WordPress.org theme.
- More than 40 inactive themes can execute PHP during Customizer preview.
- Fixes were backported to WordPress 4.7; the bounty paid was $300.
Full article395 words · extracted from securityweek.com · click to collapse
WordPress last week released patches for 11 vulnerabilities, including a flaw that could potentially lead to remote code execution (RCE).
Dubbed Click2Shell, the flaw does not have a CVE identifier yet. In its advisory, WordPress explains that it could be exploited via specially crafted URLs to automatically install and preview inactive themes.
While this may sound relatively harmless, it is not: the inactive theme can be leveraged for RCE, according to pwn.ai, which was credited with finding and reporting the bug.
The issue, it explains, exists because a value in the WordPress theme-preview URL is interpreted differently by the themes API and by the JavaScript running in an administrator’s browser.
“The API reduces the value to an ordinary theme slug. The browser retains the original punctuation and places it inside a jQuery selector,” pwn.ai explains.
This allows an unauthenticated attacker to force the installation of an attacker-selected theme on the administrator’s site. The theme is fetched from the official WordPress.org catalog without the administrator’s knowledge or consent.
Advertisement. Scroll to continue reading.
While the theme is inactive and should not pose a threat, pwn.ai discovered that there are over 40 third-party themes on WordPress that could be abused for PHP code execution while inactive.
Because WordPress loads their PHP code during Customizer preview even if another theme is active, an attacker could abuse their unprotected installers to point to a crafted plugin package that could be executed under the WordPress server account.
“No attacker WordPress account is needed. Just a single visit from a logged-in user and the attacker owns the site,” pwn.ai explains. The company has published technical details and proof-of-concept (PoC) code targeting the flaw.
Another important issue, pwn.ai says, is the fact that an administrator might not notice the abnormal behavior, given that the site’s main theme remains active during the exploit.
WordPress patched Click2Shell and the remaining 10 vulnerabilities in version 7.1.1 of the content management system and paid pwn.ai a $300 reward, its maximum bug bounty amount.
Fixes for the security defects were also included updates for older WordPress iterations, all the way back to WordPress 4.7.
Related: Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
Related: In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Related: Critical Orkes Conductor Vulnerability Exploited in Attacks
Related: Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard