The bug lets attackers automatically install and preview themes and could lead to remote code execution.

WordPress last week released patches for 11 vulnerabilities, including a flaw that could potentially lead to remote code execution (RCE).

Dubbed Click2Shell, the flaw does not have a CVE identifier yet. In its advisory, WordPress explains that it could be exploited via specially crafted URLs to automatically install and preview inactive themes.

While this may sound relatively harmless, it is not: the inactive theme can be leveraged for RCE, according to pwn.ai, which was credited with finding and reporting the bug.

The issue, it explains, exists because a value in the WordPress theme-preview URL is interpreted differently by the themes API and by the JavaScript running in an administrator’s browser.

“The API reduces the value to an ordinary theme slug. The browser retains the original punctuation and places it inside a jQuery selector,” pwn.ai explains.

This allows an unauthenticated attacker to force the installation of an attacker-selected theme on the administrator’s site. The theme is fetched from the official WordPress.org catalog without the administrator’s knowledge or consent.

While the theme is inactive and should not pose a threat, pwn.ai discovered that there are over 40 third-party themes on WordPress that could be abused for PHP code execution while inactive.

Because WordPress loads their PHP code during Customizer preview even if another theme is active, an attacker could abuse their unprotected installers to point to a crafted plugin package that could be executed under the WordPress server account.

“No attacker WordPress account is needed. Just a single visit from a logged-in user and the attacker owns the site,” pwn.ai explains. The company has published technical details and proof-of-concept (PoC) code targeting the flaw.

Another important issue, pwn.ai says, is the fact that an administrator might not notice the abnormal behavior, given that the site’s main theme remains active during the exploit.

WordPress patched Click2Shell and the remaining 10 vulnerabilities in version 7.1.1 of the content management system and paid pwn.ai a $300 reward, its maximum bug bounty amount.

Fixes for the security defects were also included updates for older WordPress iterations, all the way back to WordPress 4.7.

Source: https://www.securityweek.com/wordpress-patches-click2shell-vulnerability/

WordPress 7.0.3 is now available which features several security fixes. Because this is a security release, it is recommended that you update your sites immediately.

You can update to WordPress 7.0.3 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support automatic background updates will begin updating shortly.

Of course, all of our client sites have already been updated when possible.

Security updates included in this release:

• Pre-auth reflected cross-site scripting (XSS) on the login screen with potential to lead to PHP code execution reported by the team at pwn.ai.
• Contributor+ stored cross-site scripting (XSS) in posts via the emoji settings element reported by Asaf Mozes (amosec)
• Contributor+ stored cross-site scripting (XSS) in the Post Content block reported by n05ec
• Contributor+ stored cross-site scripting (XSS) in Quick Edit on sites with a large number of users reported by Naveen S and Ajmal Moochingal
• Contributor+ stored cross-site scripting (XSS) in the Post Date block reported by Alex Concha of the WordPress Security Team
• A privilege escalation issue on multisite networks with user registration enabled, allowing a user to create a new site reported by Aikido Security
• An information disclosure issue in the Latest Comments block exposing comments on password-protected posts reported by Ehtisham Siddiqui of the WordPress Security Team
• Enumeration of post slugs reported by HDWSec
• Disclosure of notes in comment feeds reported by Elio Gubser
• Author+ CSS injection via a bypass of the safe CSS attribute filter reported by Anthropic
• Bypass of the email address confirmation flow reported by 0ways
• A server-side request forgery (SSRF) issue in URL validation allowing requests to link-local ranges reported by Andrew Mohawk and multiple independent reporters

The flaw affects WordPress Core’s REST Batch API, allowing unauthenticated attackers to execute code on vulnerable sites.

Organizations running recent versions of WordPress are being asked to patch a newly detailed pre-authentication remote code execution (RCE) vulnerability affecting the platform’s built-in REST Batch API.

The flaw, dubbed wp2shell, enables attackers to execute arbitrary code against a default WordPress installation without requiring plugins, authentication, or special configuration.

Adam Kues of Searchlight Cyber first reported the issue and published a public checker to assess risks, holding back technical details until a patch was available and admins had enough time to apply it.

In a technical analysis published by Hadrian, researchers reconstructed the root cause from WordPress’ security patch released on July 17. The vulnerability, they said, resides in the core REST API batch endpoint “batch/v1,” where an indexing mismatch during request validation can cause request objects and their associated permission checks to become misaligned.

As a result, a crafted batch request can be processed under the wrong authorization context, ultimately allowing remote code execution.

“An attacker who reaches the bug gains unauthenticated code execution on the web server,” the researchers said. “In practice, that means full control of the site and its content, access to the database and whatever credentials or personal data it holds, and a way into the surrounding hosting environment.”

The issue affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. According to Hadrian, versions 6.9.5 and 7.0.2 contain the fix, while 6.8.6 includes the same hardening changes even though earlier 6.8.x releases are not affected by this specific vulnerability.

Because the vulnerable component is part of WordPress Core and the REST Batch API is enabled by default, any affected site exposing the REST API is potentially reachable by attackers. The researchers said this endpoint remains accessible through both “/wp-json/batch/v1” and the alternate /“?rest_route=/batch/v1” path, even on deployments without rewrite rules.

Hadrian recommended upgrading immediately to WordPress 6.9.5 or 7.02, verifying that updates completed successfully, and, where patching cannot be performed immediately, blocking unauthorized access to both REST Batch API endpoints at the web server and through WAF.

Organizations were also advised to inventory all WordPress deployments, including staging and forgotten campaign sites, and review whether unauthorized access to the REST API is necessary for their environment.

Source: https://www.csoonline.com/article/4198791/patch-now-wordpress-rest-api-bug-allows-remote-code-execution.html