puppetma4ster/Metasploit-Wordpress-Canto-Exploit-RCE

GitHubRepository PoCExploit

PoC files

15 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096, which are Remote File Inclusion vulnerabilities in the WordPress Canto plugin. The module includes a check method to detect vulnerable versions and an exploit method that starts an HTTP server to serve a PHP payload, triggering code execution via the 'abspath' or 'wp_abspath' parameters.

Backdoor review

No backdoor observed in reviewed code

The reviewed text files (README.md and wp_canto_rfi_rce.rb) describe and implement a standard Metasploit exploit module for CVE-2023-3452 and CVE-2024-25096. The module uses a built-in PHP include server to deliver a Meterpreter payload, which is normal exploit behavior. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareWordPress Canto plugin
Attack typesremote file inclusionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit module that actively exploits the vulnerability by serving a payload and triggering remote file inclusion to achieve code execution. The README describes it as a 'proof-of-work exploit' and provides usage instructions for obtaining a Meterpreter session.

README.md:3-4wp_canto_rfi_rce.rb:128-150

Requirements

  • Canto plugin version <= 3.0.6 installed on target WordPress sitewp_canto_rfi_rce.rb:30
  • PHP configuration must have allow_url_include enabled on the target serverwp_canto_rfi_rce.rb:27

Observed behavior

  • Checks the target's Canto plugin version by fetching readme.txt and parsing the 'Stable tag'wp_canto_rfi_rce.rb:85-101
  • Verifies the vulnerable PHP file is reachable on the target serverwp_canto_rfi_rce.rb:95-98
  • Starts an HTTP server to host the PHP payloadwp_canto_rfi_rce.rb:129-130
  • Sends a request to the vulnerable file with the attacker-controlled 'abspath' or 'wp_abspath' parameter pointing to the attacker's serverwp_canto_rfi_rce.rb:141-147
  • Serves the Metasploit payload when the target server fetches admin.php or image.php from the attacker's HTTP serverwp_canto_rfi_rce.rb:152-159
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Remote File Inclusion via abspath/wp_abspath parametersThe exploit triggers RFI in the Canto plugin to include a PHP payload served by Metasploit's built-in HTTP server.wp_canto_rfi_rce.rb:128-150
Payload Delivery
Metasploit payload.encoded served as application/x-httpd-phpThe on_request_uri method serves the configured Metasploit payload when the target fetches the include URL. This is standard Metasploit behavior.wp_canto_rfi_rce.rb:152-163
Review boundaries

What the analysis did not establish

  • Only two text files (README.md and wp_canto_rfi_rce.rb) were provided; 8 other text files and 5 non-text files were omitted.
  • The evidence does not include the full repository contents, such as the Docker Compose file or documentation screenshots referenced in the README.
  • Only two text files (README.md, wp_canto_rfi_rce.rb) were reviewed; 13 other files (including 5 non-text media files and 8 unclassified files) were not inspected. The repository may contain additional content not covered by this review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yaml

Created Vuln labCVE-2023-3452CVE-2024-25096Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a WordPress 6.4 service with a MariaDB 10.6 database, configured to allow remote file inclusion via a mounted PHP configuration file, intended as a lab for exploiting Canto plugin RFI vulnerabilities.

docker-compose.yaml:1-29rfi.ini:1-3

Lab assessment

Vulnerability lab

The README explicitly states the environment is for demonstrating CVE-2023-3452 and CVE-2024-25096, provides setup instructions for a vulnerable Canto plugin, and includes a Metasploit exploit module. The Docker Compose file mounts a PHP configuration enabling allow_url_include, a prerequisite for the RFI vulnerabilities.

README.md:1-5docker-compose.yaml:24-25
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MariaDB 10.6 service providing the WordPress database, configured with root and wp user credentials.

docker-compose.yaml:5-11

wordpress

web applicationvulnerable target

WordPress 6.4 service with port 8889 mapped to container port 80, mounting a plugins directory and a PHP configuration file that enables allow_url_include, making it susceptible to RFI attacks when a vulnerable Canto plugin is installed.

docker-compose.yaml:13-25rfi.ini:1

wp_canto_rfi_rce.rb

exploit module

A Metasploit exploit module targeting CVE-2023-3452 and CVE-2024-25096 in the Canto WordPress plugin. It exploits unsanitized abspath and wp_abspath parameters to achieve remote file inclusion and code execution.

wp_canto_rfi_rce.rb:1-165
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-3452

Supported by supplied evidence

The README describes CVE-2023-3452 as an RFI vulnerability via the wp_abspath parameter in require_once, and the exploit module includes logic to use wp_abspath for specific target files. The lab environment is configured with allow_url_include enabled, matching the vulnerability prerequisites.

README.md:7-9wp_canto_rfi_rce.rb:130-135

CVE-2024-25096

Supported by supplied evidence

The README describes CVE-2024-25096 as an RFI vulnerability via the abspath parameter in include_once, and the exploit module includes logic to use abspath for specific target files. The lab environment is configured with allow_url_include enabled, matching the vulnerability prerequisites.

README.md:5-7wp_canto_rfi_rce.rb:130-135
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Canto plugin version <= 3.0.6 must be installed in the WordPress instance.README.md:17-18
  • PHP configuration must have allow_url_include enabled, which is provided by the mounted rfi.ini file.README.md:19rfi.ini:1
  • The attacker must have network access to the WordPress service on the mapped port (8889).docker-compose.yaml:16-17

Evidence-described exercise path

  1. Start the Docker Compose environment with podman-compose up.README.md:29
  2. Access http://localhost:8889/wp-admin/install.php to set up a WordPress account.README.md:30
  3. Install a vulnerable Canto plugin (version <= 3.0.6) via the WordPress admin panel.README.md:33
  4. Add the exploit module to Metasploit and configure it with the target's address, port, and vulnerable file.README.md:39-47
  5. Run the exploit to trigger RFI and obtain a Meterpreter session on the target.README.md:49-88
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The exploit module's actions (RFI, payload delivery, reverse shell) are expected for demonstrating the stated vulnerabilities. No evidence of host escape, external connections beyond the lab, persistence, credential theft, or destructive behavior is present.

wp_canto_rfi_rce.rb:1-165README.md:1-122
Review boundaries

What the analysis did not establish

  • The exploit module (wp_canto_rfi_rce.rb) is a text script and its behavior is assessed from source code; no binary analysis was performed.
  • The Docker Compose file mounts a host directory (./plugins) into the container, which could be used to introduce malicious plugins, but no such plugins are present in the evidence.
  • The README references screenshots (docs/*.png) that are not included in the text evidence, so their content cannot be verified.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

2