Insecure Deserialization in Multiple WordPress Plugins

Joshua Martinelle of Tenable Research discovered an unauthenticated deserialization vulnerability in the BuddyForms WordPress plugin.

BuddyForms : CVE-2023-26326 - Unauthenticated Insecure Deserialization
Reference: https://wordpress.org/plugins/buddyforms/
Affected Versions: < 2.7.8
CVSSv3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSSv3 Score: 9.8

The vulnerability existed in the function 'buddyforms_upload_image_from_url()' which allowed for the deserialization of untrusted input via the 'url' parameter. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. 

Proof of Concept:
An attacker could exploit this issue in three steps:

1. Create a malicious phar file.
2. Upload the malicious phar file as an image via the upload_image_from_url action.
3. Call the file with the phar:// wrapper using the same action. 
 

Lead Generated : CVE-2023-28667 - Unauthenticated Insecure Deserialization
Reference: https://wordpress.org/plugins/lead-generated/
Affected Versions: <= 1.23
CVSSv3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSSv3 Score: 9.8

The tve_labels parameter of the tve_api_form_submit action is passed to the PHP unserialize() function without being sanitized or verified, and as a result could lead to PHP object injection, which when combined with certain class implementations / gadget chains could be leveraged to perform a variety of malicious actions granted a POP chain is also present. 

Proof of Concept:
The tve_labels parameter is expected to be a base64 encoded serialized object. For example, assume a vulnerable class Evil is defined in a loaded plugin. 

class Evil {
public function __wakeup() : void

{ die("Arbitrary deserialization"); }
}

When serialized, this class becomes O:4:"Evil":0:{}; which becomes Tzo0OiJFdmlsIjowOnt9Owo= when base64 encoded.

Passing tve_labels=Tzo0OiJFdmlsIjowOnt9Owo%3d to the tve_api_form_submit could allow an attacker to cause the __wakeup() function within the Evil class to execute, the response returning the string:

Arbitrary deserialization