rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure

1. Vulnerability Summary

The rtMedia for WordPress, BuddyPress and bbPress plugin (versions <= 4.7.8) contains an unauthenticated information exposure vulnerability. The plugin fails to properly restrict access to certain REST API endpoints or frontend localized variables that contain sensitive configuration data. Specifically, site-wide options (including third-party API keys, license information, and server paths) or private media metadata can be extracted by an unauthenticated attacker.

The vulnerability stems from inadequate permission checks in the RTMediaRestAPI (registered via app/main/controllers/api/RTMediaRestAPI.php) and the excessive exposure of the global $rtmedia->options array in frontend JavaScript localization.

2. Attack Vector Analysis

• Endpoints:
  1. REST API: /wp-json/rtmedia/v1/settings or /wp-json/rtmedia/v1/support.
  2. Frontend: Any public-facing page where rtMedia scripts are enqueued (e.g., activity feed, media gallery pages).
• Authentication: None required (Unauthenticated).
• Parameter: rtmedia_config (JavaScript variable) or direct GET requests to REST routes.
• Preconditions: The plugin must be active. For JavaScript-based leaks, a page with an rtMedia shortcode (e.g., [rtmedia_gallery]) or the BuddyPress Activity page must be publicly accessible.

3. Code Flow

1. Initialization: In index.php, the global $rtmedia object is instantiated ($rtmedia = new RTMedia();).
2. Option Loading: In app/admin/RTMediaUploadTermsAdmin.php (and other components), the plugin frequently loads the entire rtmedia-options site option:

   $rtmedia->options = rtmedia_get_site_option( 'rtmedia-options' );
   

3. Localization: The plugin enqueues the main frontend script (rtmedia-main) and localizes configuration data for use in the browser. In the RTMedia main class, wp_localize_script is called to pass values to rtmedia_config. If this call includes the options array without filtering sensitive keys, it is exposed in the HTML source.
4. REST API: The RTMediaRestAPI class registers routes during rest_api_init. If endpoints designed for debugging or settings do not implement a permission_callback checking for manage_options, any unauthenticated user can query them.

4. Nonce Acquisition Strategy

While many REST endpoints in rtMedia require a nonce for modifying data, many information exposure vulnerabilities in this plugin involve GET requests that either omit the nonce check or use the standard wp_rest nonce which is often publicly exposed.

To obtain the rtmedia_config data (including nonces if present):

1. Identify Page: Identify a page where rtMedia is active. If BuddyPress is installed, the /activity/ page is the primary target.
2. Create Test Page: If no public page exists, create one with the gallery shortcode:

   wp post create --post_type=page --post_title="Media" --post_status=publish --post_content='[rtmedia_gallery]'
   

3. Extract Variable: Use browser_navigate to the page and browser_eval to extract the configuration object:

   // Target the main rtMedia config object
   browser_eval("window.rtmedia_config")
   

5. Exploitation Strategy

The goal is to extract the rtmedia-options array, which may contain sensitive keys.

Step 1: Probe REST API (Settings/Support)
Check for unrestricted access to configuration endpoints.

• Request: GET /wp-json/rtmedia/v1/support
• Alternative Request: GET /wp-json/rtmedia/v1/settings
• Tool: http_request

Step 2: Extract Frontend Configuration
If REST is restricted, extract the data via the localized script variable.

• Action: Navigate to the homepage or a page with [rtmedia_gallery].
• Tool: browser_navigate followed by browser_eval("window.rtmedia_config").
• Target Data: Look for rtmedia_config.options or rtmedia_config.api_config.

Step 3: Check for Media Metadata Leak
Check if private media metadata (ID, title, owner) can be listed without authentication.

• Request: GET /wp-json/rtmedia/v1/media?per_page=10
• Tool: http_request

6. Test Data Setup

1. Install rtMedia and BuddyPress: Ensure the plugin is active.
2. Populate Dummy Sensitive Data: Add a fake S3 key or transcoding secret to the options:

   wp option patch update rtmedia-options s3_secret_key "EXPLOIT_SUCCESS_S3_KEY"
   wp option patch update rtmedia-options transcoding_api_key "EXPLOIT_SUCCESS_TRANSCODING_KEY"
   

3. Create Private Media: Upload a media item and set its privacy to 60 (Private).

   # Note: Requires a user ID, assuming 1
   wp eval "rtmedia_db_insert(array('media_id' => 123, 'privacy' => 60, 'media_title' => 'SENSITIVE_LEAK_TITLE', 'media_type' => 'photo'));"
   

7. Expected Results

• REST API: The response should return a JSON object containing the rtmedia-options or system debug information.
• JS Extraction: The rtmedia_config object in the console should contain the s3_secret_key or other configuration parameters.
• Media Leak: The response from /wp-json/rtmedia/v1/media should include the entry with the title SENSITIVE_LEAK_TITLE despite it being private.

8. Verification Steps

1. Verify S3 Key Exposure:

   # Run after HTTP request
   # If the response contains "EXPLOIT_SUCCESS_S3_KEY", vulnerability is confirmed.
   

2. Check User Exposure: Verify if the leaked REST API data contains user emails or internal file paths (e.g., ABSPATH).

9. Alternative Approaches

If /wp-json/rtmedia/v1/ is blocked, try:

1. AJAX Endpoint: POST /wp-admin/admin-ajax.php with action=rtmedia_get_support_data.
2. Shortcode-based Exposure: Some shortcodes render attributes directly into the page source without escaping. Check [rtmedia_gallery] output for hidden attributes or metadata in JSON blobs.
3. **Transcoding