Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage

This research plan focuses on exploiting a race condition in the Magic Login Mail or QR Code plugin (<= 2.05). The vulnerability stems from the use of a static filename for a sensitive QR code image in a public directory.

---

1. Vulnerability Summary

The "Magic Login Mail or QR Code" plugin allows users to log in via a link sent to their email or by scanning a QR code. When a magic login is requested, the plugin generates a QR code image containing a sensitive login token/URL.

The plugin saves this image to a predictable path: wp-content/uploads/QR_Code.png. Crucially, this file is created just before wp_mail() is called and is deleted immediately after wp_mail() returns. Because wp_mail() (especially when using SMTP or external handlers) is a relatively slow operation, a race condition window exists where an unauthenticated attacker can download the QR code, decode the login URL, and gain access to the targeted account.

2. Attack Vector Analysis

• Endpoint: The magic login request trigger. This is typically a wp-admin/admin-ajax.php action or a POST request to the login page.
• Vulnerable Action: magic_login_request or similar (inferred).
• Target User: Typically an administrator (User ID 1).
• Payload: The username or email of the target user sent to the request endpoint.
• Authentication: Unauthenticated.
• Preconditions:
  1. The "Magic Login" and "QR Code" features must be enabled in plugin settings.
  2. The attacker knows the username or email of an administrator.

3. Code Flow (Inferred)

1. Entry Point: MagicLogin::trigger_magic_login() (Action: wp_ajax_nopriv_magic_login_request or triggered via login_form).
2. QR Generation: The plugin calls a QR generation library.
3. File Write: The plugin calls file_put_contents( $upload_dir['basedir'] . '/QR_Code.png', $qr_data ).
4. Email Sending: The plugin calls wp_mail(). <-- Race window starts here.
5. Cleanup: The plugin calls unlink( $upload_dir['basedir'] . '/QR_Code.png' ). <-- Race window ends here.

4. Nonce Acquisition Strategy

Login-related actions often require a nonce if triggered via AJAX.

1. Locate Nonce: Check the WordPress login page (/wp-login.php) for enqueued scripts from the plugin.
2. Identify JS Variable: Look for wp_localize_script output.
   • Likely Variable: window.magic_login_vars or window.magic_login_data.
   • Likely Key: nonce or magic_nonce.
3. Extraction Command:

   // Example extraction via browser_eval
   browser_eval("window.magic_login_vars?.nonce")
   

4. Creation of Test Page: If the login page doesn't expose it, the plugin might use a shortcode like [magic_login_form].

   wp post create --post_type=page --post_status=publish --post_title="Login" --post_content='[magic_login_form]'
   

5. Exploitation Strategy

Step 1: Preparation
Identify the target admin username (defaulting to 'admin'). Determine the upload directory path (usually /wp-content/uploads/).

Step 2: Trigger and Capture (The Race)
Since wp_mail is the bottleneck, we need to send the trigger and immediately poll the static file location.

Request A (Trigger):

• Method: POST
• URL: http://vulnerable-site.tld/wp-admin/admin-ajax.php
• Body: action=magic_login_request&user_login=admin&nonce=[NONCE_OBTAINED_PREVIOUSLY]
• Content-Type: application/x-www-form-urlencoded

Request B (Capture - Concurrent):

• Method: GET
• URL: http://vulnerable-site.tld/wp-content/uploads/QR_Code.png

Execution Logic:

1. Start a loop or multiple concurrent requests for Request B.
2. Fire Request A.
3. As soon as Request B returns 200 OK, download the image.

Step 3: Decoding
The captured QR_Code.png will contain a URL like:
http://vulnerable-site.tld/?magic-login=TOKEN_VALUE

Step 4: Escalation
Navigate to the extracted URL in the browser to be automatically logged in as the administrator.

6. Test Data Setup

1. Plugin Config: Ensure "QR Code" is enabled in Magic Login settings.
2. User: Ensure an admin user exists (e.g., username admin).
3. Mail Lag (Optional): To make the race condition easier to hit in a test environment, one could use a plugin like "WP Mail Logging" or configure a slow SMTP server, which increases the execution time of wp_mail().

7. Expected Results

• Trigger Response: A success message indicating a magic link was sent.
• Capture Response: A binary image file (image/png) found at /wp-content/uploads/QR_Code.png.
• Final Result: The decoded URL redirects the attacker to the WordPress Dashboard with administrator privileges.

8. Verification Steps

1. File Existence Check: Use ls -l /var/www/html/wp-content/uploads/QR_Code.png during the request to prove the file is written.
2. Session Verification: After navigating to the magic link, use wp-cli to verify the session:

   wp user get admin --field=user_login
   # Check if the browser session cookies correspond to the admin user
   

9. Alternative Approaches

• Inferred Action Names: If magic_login_request is incorrect, grep the plugin source for wp_ajax_nopriv to find the correct trigger:

  grep -r "wp_ajax_nopriv" /var/www/html/wp-content/plugins/magic-login-mail/
  

• Filename Variations: If QR_Code.png is not found, check if the plugin uses the user ID in the name (e.g., QR_Code_1.png - inferred). Grep the source for .png:

  grep -r ".png" /var/www/html/wp-content/plugins/magic-login-mail/ | grep "uploads"
  

• Direct Pathing: If /wp-content/uploads/ is protected, check for wp-content/uploads/magic-login/QR_Code.png (inferred).