安全研究
CVE-2024-10793 WP Activity Log 存储型 XSS 到 RCE：日志页里的完整链条
Thinking
2024-12-25
1 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
WP Activity Log 把用户行为原样写进日志页，没有任何 sanitize——存储型 XSS 触发后，攻击者拿到管理员 nonce，反手上传一个 PHP webshell，整个链条从一条日志走到 RCE。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237684cf8d236b0cc15c80dc1c718fe5b353dbcedcb70010a7bbf57ef3dbbad10c417d8272a5879d09cc564d2c0ff9139a82a035e138d0fa2d14c23bd4fb912def58527936c1ee727c2f4524e00c48f5f8a5ed8bf2a112872fb0c5af1b8af8e5852fd51fb871d7229f92b586cef0b6689f99c25397ba4744a508d613194ad7e16c563d83e079a1477347bd26ef44144a1c08e54f3c471687c52476e45a85fecc67b8f02301bc02dcd51147303ad79b9384d242f1c7c5f265ffd809c1f11766469bf3afdc65b19e7cf26f5e83cc12217342866c975b88b4d3703be647e1f8354227feda1f1ae1b9a262952ef031c171f4e34e2657af4fa0207ce2daf9feeeea9cb41f08b4cb83855e1a3987964b6706c74f1ad2eefa595bf714f1062363b2bcf09a0d64e0fe8d9acd48802702a1ff9301550e61cd8d2cc9bafc7c74b0f25bdc23054aa4dddf331011e5e2e0917f0f3773e4e2220a48d25ec85bff2c1fbe5664440e71e983a76d8b79ed1bedf32c331867b27f489a645f7efef4766ca7e7b2137b5e63a9b89cfbe1bbff21c01bc1666b78873e6642c47478bbe192ffdb890a2c3982274adb88b7318b43ceaf0cca0f94b9c543c4cf04626405c587fbd7d44b577e8212f838cbb04d9dc27dd81de84c8b9bb805da327731aaf9a3fd2bf0f8ed6a5474e06b4b8c140733ed01471071929c4cf432b8f28781f39da9b3ff3b084c2a83e91562d42c79af3ddcb3ffe75d9b8360c438f81ea6c8f5b85aaacca0d85eecbb11341557883f7a0815d77c391fdaec69a9940fea341ca575f0f4c0584a390e768379615b5960aec0f4fad7b651fd93a5622c661b5e9fb82a0613e707a16c1cef89df6df0149bee8013ec7598c9edeab243a637b41db513e4c62bae08c833d7d6d4010b7d5aea4bbc334511e57f431ed81d1ed59194bc13d6b5e9b33678965b4c744d078c1d056fdae9fa941540717e91fadef051b8c1b4fdbb65d38678739d5445e8486036e7802184a745e2b3bc7af0fd49807643720f333cba880008e5511fbcef5274de998e1624ab1ca82a618ef497e56c6823a66dc16bd8bfeea777d5ac22644bc039001fcef455017e7e38032738a186795b7934e7a555859a2eb5524e217b06df498df74e40c0f59dcb130cc0ef0e3229311bac838d647ad8e89f003e0811cd93140c7b0c7b776b2c065d19380d179528cddc632e88bb841ee757a11777c75565904dd6f382a8b182b7a04e047847aeaf580e5094704b09aa18cb6e62741d0e7139dfe3575fc272f7766e660c0f89f5ef035c119d498140158f60f27cdad990dca22c557bba09982d5eacaf8b9a7712095d3007e86e3ea209db4cd82045af0c204825bf844069e59030a404317c0b2c33cc7db5970cd81f541aaab90f3edbfcc6e28ba1690c1fba860cd7c47b7aa6ce422668fc78fa03e7a73b398dfc7ca1c3d8c060152bee573e8f9f3b68db246d52379e2476f6c30ca306b6ae3741fae21839e812a6337f3f68d2562f64bcfbf9b6dc1d58a751331aaac08786819d0bd45564c1a814e5a88125674cb2116629d1723cd9667abe70fd093fc46e88c10d3dd786b656d4b1a1530896df78a0f1a0be940eab51778ee23aef3fffded2945b5ea2191c2a5e9b920dc12de461459a6fd440d2f675170785871c6a597f5d2576a7786d29ff0020ef42fdd470f3fa36181816df87e26f78b45f513fc98b3f9af3150cb79ceaacb188ce98c8c756dddbf03308b2ba3994ec351f20c834ccd61b12e8568b4c75f903b8f3059b6756130a97b49c0ea9351954166e45739fe3112378bb4e371b702cf5f5b3416d60252bd152db2f8469cf344ce898b9d1b12e8a8f9739ccc675258fd594d77d1da67bd890d69df5ae134ec6288cc06053af85de62ba091239e61d725fda4dff7cc1869a86588ccf2a522366903a8132205bd6e8c6a9ba9d628974b72e53cdd8076e92523aff2ed3adc03ff4b68faa6e215e480b20c3e7ca3fc58d85c5c390e350209ab6ad9c7b5954c97dba8385bf44cbfb722edac47ea888ec807eaecba0921403216780f1d621d48a4e5dbcece5c080da6887e8f832ff5eef7236b559b1a0c00053ff5ecbe8290b485350b6aa8ea0d49b24e7e601c9a8f26793b5f531879345360e8f2c57ece51c1c092d52d02da35050657c5ba030af38313546fd21ea97fc329eac6976086d6770201dfd44a7f16065dba23775612ebfb3aeaf631ef5d0647425417f25c6fe206cacaf38f8ea67d56f244d385fa345a8a63de40d952ee5b4f96de87a88fb775d3f6f0fcc96666a91cdbe2c8bdbe75239fcecccb16b0b31a542f69dd6d21deabbb319937c81c7aba82d4538bb9e0915197686530a47324ce6415de915f1ccc7cc178a5be432405ddb32acd92e354b8586c078f84047377b679d62b7357c07826e500f1af316866c6f12fecde440a38be3d46899f04d0dd5f63f6c8e252892760025ecadc5e451d494d25e8c5db835c8116ae33ba20fa8d690926fba367326e27f198b8e2c5a5eae9f2e16b9183f5b2e93ccf139934180f138a5cadef9a1932491c2f955d7ad7d76d7f0621163a21be6995c895e59b3f63eb1becaf3a8cdd0a207952d34106c1f7e7001da7cc767ec4688c64bfc437ff9082308480bf7a47d189c9a6279b4bce3fe65e5def7e1470981d8ca6f51663c0bdf33e623dc03e837d31dd07596b7b5c3cfe4483aaeb658cdf71052f9d40892202b07bd7a3efd8c90b134b2b3a71dc608bb809ffef45778783a687280ef68f38599c63731a41c7a5522a4ee723c059e0544fc66a0c2813fba51d269993a77953681b92a9eceb47c94591c678b0244ffedd76e47e8dbbf0a88178255823bfb1970d3571789f25eb5b9e51b29679f723d8568148ad53792a02098af612e7889a3c379715fb366b4f2621e92994f5f6d0d055da8a38fae030c5a51cb5e76aa21865ada4d66b9d4aa943976f6a8278388e6a3d99e9a140d165eb795d504fa985b80ca25d736f440f50ebad76dece8d3c76771311d49e6402412d8b9c84239c39b39cd709e84c98302e745bea50d64bc97613549f5a613e06ce6ec9145d3a1fb92f9613707bacd7f4221e5db5ff23ac599afd6005ee66a8976757b0db7944c6187b18cf9ab743125e4be7050aa9a3bc5c3d08972064c62e8a5cae32faa899066eef3514078ddc74528a779ca73f9d2ee9609e42ea0b1a4b14832cde81fe4b8e3f063c0910a495ee402e40ff4720135c3ef4fe6fc97040894a62c475374b6cdc4901ee8ab901e1bf4c6a001c4a7ac1a92d9cbc68fbc8beddb8138bc9d667e80ff492d041c29206a31cae0f09b87e24a376482ce885d847e097fbe3d81e6a439eca2d4bfad375366674eb87059f9a3e740facfc6778737426b54bf8d180c45a8be78de4247070dea3ff8d01c8740961236e46028df3f70c699781fcae4df12b43c2e54db6a9860750780d1dc9e50051ffe5bab1912d9c273ca3b287a2ab8e71720588fcfbb9d510b351af29242df06705c103968cf64a070abb24e1ed838b1905ef89a96d7a76abef6504e5de71ae0a3c7eeb5859a3d49c3b5b956ee49126accc389304eacba163f0c44e29ee819240b33fabdbb9805ca9ad6f5aa10ed4bc45d16364afda5e2aa0b6db7eabdef7f8f90a1b3a843bb110f3239541a05e607ad25306bd4b1d56326664653b907264c5d65813eb1211d0bd67b79a1e469cd38e9a71b72c206ee4fecf8c5a3f7fb4b2c7081af77e4a8ef824635e0d84a27b4815a4473bf3cec6e5a0616a1518444ea3720ab7c4e998c87c4bbfcf605873edf29a0dd863be1596d76004a4be0b375a906ebb0722441ad16def7795e73c9e21a2a939c8e01cbcaa335e0d59aa9f043ac4c0a2e94573b0dbf34cd2d41a0bd46f71481530a66c635adaea5fc5f21e4acb0550033f00d3c05257540fb217762e17650f5448b563535179b36d79aa55102e872ca12cfd3e9717198b9b2e960d2631912ecbb66d1d08408648157fff24d81ce14b128af847f0f731c4e570a507f7dbce5820010b35522f52b46815b3a409a63dea3c1a40c5468711d1ea486bc68efdadd00359e296c2af3d3c7805df00d6bc689cfd39ddcbdc149cd616a4c21dd1be802529a5378e6f0df895912a5e79bfd4344509d3fd5f65d920713145dca7c76f14096346d8437a8f1cc55d9f1119a261258312b6d7954fda11ac9c03cfdadffc7c4882280c5c1cb1b610188f3b9315127cccba4ecf0269622b97f02aff10981433def19177d6409063cd631c4fc4b37d313e46c33230cd879b3df4572190c96fe633bc4304ada2a0e05eaef18e55220411f8d95b786db4a69dbbbb0a66b61b9f7a40ac9aaf8ced83f97f1264afad7c26b45d5a3d70285c5fa77e0376a2471632b08d5d84686d7379a32360513a8f9aee789aa5de5a90135e1100ff621f33dc66726677c7e912a173f5d2f5b176d901a0c2962128e66b8c24a3126552a770de827855c63a5355089e3d5cc610d23c7e525b98a465815385bea3adf0b2d47956adeb7e728e694477524039fd484f751e58d64c452010a95a3373e1deb198c908f1de8234cc68431b693548a0c27a2015538b010931c33213da346672251a6d6810780ad0df8ffd55e72f98e1721bc0ba79fd71ef7b837f5df273b732fa366281b68c98241c8c9c8d41940b9d7cd0bfef5b5d98dfd4c50d9e33f1095798ae4a62e08e9174df82523e56b829801d9bcd5b88ae9b99389ad21191de49c6ac9e341cdcea9fbd2f996d86d84f140a71f242fc0aa914b5fc058ed55afb77d799eb782dc39ab9dbf1dc0b301b94b6f909e9cd13456ac95d7368dc257765e5c137afdd4aaee54720a7d77bcc87d4f55c0ab70492ce818cf813c655a8ca15e3c65e1c728874035461bcc29873a04bc55ca01a30268f72feba2eecbff680db78a5fbf4b44d0d87ca00e5bcdbcfb33f790c7c65aea300829870c37f0833c1762f5168c20fcb1513df5b0fcac0ee54484b892fb762efdfa137a16c50f4fd39f49749c66f06466c938b53fb911474b92a93fb3d0146fa827b22c35722416cd880e41ef3018c5c408c91f3a1e464dc3dde892dc5635c32541b583a1bde7b1a7b2a189844423175325a6222e85f55304d581938b87db1ec8f57aad9b3fe70c7ebf6d26d31e1190e07a05e6566a015e043054659c60295cffea559873e0c18bfe0a629031839f34d6043f9203f34c8955f7de0c3bb538eedbe19822b52c5a511734af876b61b64335263435300442135a17975e2cbb13a09b0a13d088a6e9c405b0eabe61ac3553374d35652847835370a5b5f4e7c388c55f5221329b56b79f8038de465ed61fc1bb9a69ed6e0f48f6a05424ebe9e220765392bb4504e0c8513000b6f0152c57a595dd703274523e504a43106ab482b184a97375c5184d21c402e2275c2939c8d2cd58ee1a3739d9fedce01d8d0e53df2a4aa6c15b6b3a33bcfabd35f19c796d2c83ed4bc575a811a126d802e7920eea383fb60b998961865e7f7b6a281779e00f6c620fccc9971e5c999006c6b8d4e90eea47bf96cfd80be802669ac9b36b677945d99c527a68f03a45acd6e1f8b67ded2859b7dd88fc4f0dc01b448179138d2f3c454e0bcec3294cc2d7cc899159eff33e373724c850de50a478a036bf4af4374546164351042a5841c863eb7bd3bd0d628a8d747a2ff704c73af0cba6bfec0f1ee970b03ab4dc1ac7ad8feeeec766f471152f60b5e6fdfa35b398e4adbb53fb8a79a1d2f7ff74ec2d265b6008c4aef682496d87aad01ebff8fc9a05fd13f24856b97fac5a71817a940edcb666d7bb9fe7e5f8498577468d2a287d750d4597d9ca4ad8e12d9750a42ae8150c4ef071dbbf9c2c0a1a4c8cbc1df4e5ab83d218610350428c207eb24a7c2c54ca2631b168530393ac093f0d426719de43dee2d70b683b5b9f3eb8daa7012e1901f6f902144c01cd88b0d7965b45c256c3fd7201f56a9b5d50c067b62f536532bf2ddbccaee5e57604da6deb9c72ea1415ab09489f4979263c2e6e021383d52099c493c3e40b17c7f88df9ce12649b9fc5861a5fff107090d7d33f6427c1cea5304838ae0af8a7d2e48ded059ad158856840f6fb0434606d365f84451efa20dd10f7e2b77171f8c7f26818807fc984de921bbf2c59643a999b5718bb697a52390446c9d636bfc4c884102987c7e7602b1e6607ebabfc0aaaf1e1af41e8b7d5f675fa6f4629330a1b76c58fedcab36f8849c39c0718c0df14b2f0bb9302a2552de54b2a82c66f8cae30115b84aaf39dee602cc6b3d6a956d72ae5f216e05db1d4238e8eb25904a66bbf0615abbd3bb94e32d93fd1a2899be903687d30f48e81aa494827db73ea31353ac4b0c1a73aae6dc60732e75e7576c734999402944fba26b1865e19fb17331f872354dccf3d00f8076de7c1405f7938562a935c6e7a359d424d500090f1e7fb96284c2195d2fc4d84ff1a5f27dabfc841db3c339cb8d69e8fb173587cc5c7a0d8093a28aaf4a7b5f1a7a3652460ea51d7f0af8621ba6d0d3b26cb527eb9ca7355c5a46fba7e9c65e398c4105b744844e77015a92e623639bcea079dda445b9a15a5dfa26f87de584544a970699bca714b7f5ab1873b6bc6407e0234c10c092310b4190ef58bfe4cfb2cb2e951a2ae0711b138da747f8fad1b67429ae72285d4006816620b476402cdda1f0658df236c9322091ea8aa279636d2a1439bd4957cdba3bd3e8d857a2ab5a385e167a01e9fba5ab044400add3438a6f70fceaa3e8fb9c2dfcbb3377f5471a02bf43624c8b53cca4b835247c54a55d95bb07f9030223b9c0606aebc92f0d35b267e7c07b5c1d9e7ca53b3dc3bfde51f306ecfdde9b76dd86cb5d4ac67431aa2660c24acd204bbc1228334a4ea26ebd94f715b213f47f2b095c26d322faab5b0238949f54ba5e8ce3e8597bb077855dca9caf2eef11e38a97e4bb67be263d4f9941090eea827f3f978410888a0bef385a8ac97fdc0baebec3409c979bc2a5cd55861c9e0d74e9bd697f2d4e5985f6d7bde7f18aea8ccc9df649189464c488979e9694a806cb86b73953de2cd0710ba36c155ab93f51641fceb72edf34b48c5303416ec58af5c977b6827deb6b2b5ec2c0c620d4a2c698f135b4a4a2c5abb18e2ce39871cc5a8dd7ca57f24d621e808203c8e72cf28bad808ca7f7c41c16875e891b7749b3cd8332d936fbb2f9d3f14cea8ce5a3519ea169a0a0f573a9471da12b8749cd806b4258003008668bd9551146664f3ddd7f81d9f4d4db449df2a49d0d72cd0288b9ffa4a58f02d6953142eebcba9174902afa7b2793fceccaf0bb5b02cbe8a5fc2e9428644aa83b8a25b1ca47e5ffb4d6329c0522f8f95220925a81fce5ca8ddb6df7e656bbc6403cecc76b9b200340e169b9525d22c9c0d512169a7f38eae76370f0b5ae620dbc94b9f353d11ccf862e4a2da06aae63359cadd4328a8149a73cac0dbec7b8ba8f3616ff406d43059116b87d8d9b4bdb4215fbfc323afbae3cb7f9f07012cb984e440483c7130e9384e5087d1b307988b68925817d304f29071a82b554415627f30e58864d89eaf8224e0921d7cc2f56a00f6f6c4b5f2332ee2ae5a8b48a1012f03db480e9d5b966c3b136e246ca3cb276c9cf5e5d452d1c956f4b1d802f6d62e8ec2498ebd67c3731cfc2439190c5ac22224fe085d8557dd9dbbbe189f23a6b8906d9ce6156dc92d2573eaeeb9397fe922e9efc6a9702691082b181c572f69d5fc53e1f96ae3518ce79f229f7810c463c4908af7bd47f36f22d8162709784d76c354f94c4e643eeaae9becec0e3103eb18bcb804f855db7936783a1b1214df5d7a661ce6b9b48be9e47f296867a6a01285749937720ec0f5cc64e693659547ebaa66d26d54a8bda26bca18444012920ed3b77e676a9e95c64ae1e4328d7d57f515fe639c85567b533de857b736cc61e13deb99da82f9c2967827728af8b865a8c1aefa63571d79bcb5ee53e70cdcb5a7430e036e49d7b8c9f238a4667929e7c68ff841607605987ea5e1a9f7939f6ab245653ba5534f840df9927f3eaa753ac0ead2cc139610363559b71284bcd00712d376ac6ff1247737f0eee9029e9c3b55a054c6bd2de627f5666f78653208b9c7b2040848ff27be626804be1bfe29574a226bbb5be5288568672c7d568e6d89d1c1e931b3f096b51a00cc4666e9ab8b95b33e9de83b1a25f96f08c1d45977bd0bb33797d67ba80890cc9c230562b53180cdd5c88e19cc0d53f7802bbd7315783290160952303760c20ec59556dd6d86d8698f19fa0858aaff161c08b40899e973deadfd5369be966f0f7a30e634dcb2ec24478ee52d24c6128a0e08331e1416e8801af179dd78c1aa5249efa8c5a70dd68c4e0d3fe0812ada85e254b0bf2398959d962559a7afa3f1842a9104d623e1f9f11a380ce60451269d1a36ab7b4f79fde67ad9d832e0440e5feda2a4b0bd2001c485498603358313f64a921ad5d2ec90f3d3b1ba33cdd6a78aa78dcf807c747b776cb2c8396defc1e9633acc950dec73e7f4e0494749a469d31b2d20fa998a079e23e40d10f982e7dd361e4e82d5ae3a1975771830a6a9c28efa74b3b68b0d8983d04f69ec28205982fe388f1eb4ba82839714271dbaf8ba0ce69d77a679a356c8ba7e77211062ed5ff9eb986b74e226d87b3274c9f02d8df0be197bf76d0f172dcec8ed9a88471826a4d0f5277702067f74fc3fb5324b7334411fe3799d75a4dbd5da7f3a3952cd0ea3232b2740d84f96ddd9067595ef9961f8433db98c456a3e7b83505f05400a10d3524eccb8ba48b74516fe92b2d7ecc01466f9c05c37966d9f7e3080a697b6e069184e309104a7bc2ea666f92d650d28ec64bae0f24bbc53f24dbebf8ff85aad47d0078aced974cae387e3d385a0de943cffe9b66cf605e2e9b5d60a4b5038774a40a28b6c024f275949378db2765348bbd6b1f4d99b4c75c5c9475e6f0ad5f4bae9e8ac9515241a6b299d4846d5285e908331d8447cc7ded8ab87d68f3322f8939701bc307ac998ebabc12f4e2fcc013f9a41ce2ae51d61d0ad2c58a732c9bb8cb4ef0dafe781c1275890ef95a345d97b572da6b0231142a5be306fbe39c9f94f3af3e6649f725ff0020dea9a77c1f43ae9cdaed6c70490304053396d9b1ecc215f4104ba3a68f0f2bf5d05f932a7d6b4f20b66e95aa28ccd6d35838f2bf3435c07f7f3b41edc2ba41a68623647a49830fc2314150bd1765eef737dd5a93a6f9a230ef1048300e32497b3a5d38198e2093a6f48a38f5e07d69954ac8604096e9507beff18aa09b4962ed1955a30b7fe519a5dfbf6a6abedc3cad91fd9202333b93e19f5fb7e9eaf063559ed75b5037c6bb89cd135a26fc51df4879d914d6c34e3d52ef6a2875221c852d25e3571a0bfc9a6aaace6e4884155bbf1bb605015e0cef228e1db1cf9b01042169d7b7e61d199801f03a80d5f140efec9b97cab3e7dbc4e51aa75751961138da5720012eea46585ed7dcf2e74ae46e5a8a6998b54191ef37dda18fff5ec247b3c00787c26dc31d6b94a621e438707afb22a2cbe6a565d6f4addebfbfb74ddacf4683287e7e751b43db12a14a4d0b52defb9540f5cbb947b5c4f264ec1136a75b3356a6b7ffe3a8b85f6d511ef23dd6aea6404018231ad3d6906f4ea71c600cddc7232