CVE-2023-3452

Classification basis

The primary artifact is a Python script (canto_exploit.py) that actively exploits a vulnerability to execute arbitrary commands on a remote target. It includes a full exploitation chain: vulnerability check, payload generation, HTTP server setup, and RFI trigger. The README explicitly describes it as an 'Exploit' and provides usage examples for achieving RCE.

Requirements

• Target must be running a vulnerable version of the WordPress Canto plugin (≤ 3.0.4).canto_exploit.py:110-111
• The attacker's machine must be reachable from the target server on the specified payload port.README.md:99-100
• The target server must have 'allow_url_include' enabled for remote file inclusion to work.README.md:17

Observed behavior

• Checks if the target is vulnerable by fetching the plugin's readme.txt and parsing the version number.canto_exploit.py:94-125
• Creates a malicious PHP file (wp-admin/admin.php) containing a system() call with the attacker-supplied command.canto_exploit.py:62-73
• Starts a local HTTP server to host the malicious PHP file.canto_exploit.py:75-86
• Sends a request to the vulnerable download.php endpoint with the 'wp_abspath' parameter pointing to the attacker's server, causing the target to include and execute the remote PHP file.canto_exploit.py:139-144
• Displays the output of the executed command returned in the HTTP response.canto_exploit.py:146-158

Observables

Exploit Mechanism

Payload withheldThis is the core exploit logic, consistent with the documented CVE-2023-3452 vulnerability.canto_exploit.py:62-70canto_exploit.py:75-86canto_exploit.py:127-170

Network Behavior

Payload withheldThis is explicitly documented in the README as a feature to support HTTPS targets, and is a common practice in exploit scripts.canto_exploit.py:29canto_exploit.py:101canto_exploit.py:144

Payload Generation

Payload withheldThe command is directly taken from user input or a default sanity check ('id; whoami; hostname'). No hidden or additional commands are injected.canto_exploit.py:67canto_exploit.py:266

Classification basis

The artifact is a complete Metasploit module that actively exploits the vulnerability by serving a payload and triggering remote file inclusion to achieve code execution. The README describes it as a 'proof-of-work exploit' and provides usage instructions for obtaining a Meterpreter session.

Requirements

• Canto plugin version <= 3.0.6 installed on target WordPress sitewp_canto_rfi_rce.rb:30
• PHP configuration must have allow_url_include enabled on the target serverwp_canto_rfi_rce.rb:27

Observed behavior

• Checks the target's Canto plugin version by fetching readme.txt and parsing the 'Stable tag'wp_canto_rfi_rce.rb:85-101
• Verifies the vulnerable PHP file is reachable on the target serverwp_canto_rfi_rce.rb:95-98
• Starts an HTTP server to host the PHP payloadwp_canto_rfi_rce.rb:129-130
• Sends a request to the vulnerable file with the attacker-controlled 'abspath' or 'wp_abspath' parameter pointing to the attacker's serverwp_canto_rfi_rce.rb:141-147
• Serves the Metasploit payload when the target server fetches admin.php or image.php from the attacker's HTTP serverwp_canto_rfi_rce.rb:152-159

Observables

Exploit Mechanism

Payload withheldThe exploit triggers RFI in the Canto plugin to include a PHP payload served by Metasploit's built-in HTTP server.wp_canto_rfi_rce.rb:128-150

Payload Delivery

Payload withheldThe on_request_uri method serves the configured Metasploit payload when the target fetches the include URL. This is standard Metasploit behavior.wp_canto_rfi_rce.rb:152-163