Closer to 0-day

Closer to 0-day

Speakers: Emil Trägårdh

Conference: Security Fest

YouTube: https://www.youtube.com/watch?v=8nUNZVAtl94

Overview

In this compelling talk at Security Fest, Emil Trägårdh, a Swedish ethical hacker, challenges a statement he made in a previous year: that n-days (vulnerabilities for which a patch exists) are as close to zero-days (vulnerabilities with no public patch or disclosure) as one can get without being the original researcher. This presentation systematically deconstructs that premise, demonstrating advanced techniques that allow security professionals to inch significantly closer to the zero-day frontier, even discovering and exploiting vulnerabilities before a public patch is available or widely acknowledged.

Trägårdh guides the audience through a journey, starting with a conventional n-day exploitation scenario using patch diffing, then moving into the more ambiguous "gray area" of unfixed vulnerabilities, and finally culminating in the live demonstration of a previously undisclosed vulnerability – a controlled zero-day. The talk is not just a showcase of sophisticated hacking skills but also a deep dive into the methodologies and custom tooling that enable such discoveries. It underscores the critical importance of understanding software internals, authentication mechanisms, and file upload processes to uncover subtle yet critical flaws.

This presentation is highly relevant for penetration testers, security researchers, and developers alike. For defenders, it highlights the constant race against time and the need for comprehensive security practices beyond simply applying patches. For attackers, it offers practical methodologies for vulnerability research and exploit development, pushing the boundaries of what is considered achievable without direct access to vulnerability intelligence. The insights shared are invaluable for anyone seeking to deepen their understanding of modern web application security and the lifecycle of vulnerabilities.

Background

▶ Watch: Introduction to 'Closer to 0-day' and N-day recap (0:00)

The talk begins by revisiting the fundamental definitions of zero-day and n-day vulnerabilities. A zero-day refers to a vulnerability that is known to attackers but unknown to or unpatched by the vendor, giving the vendor "zero days" to fix it before exploitation. Conversely, an n-day (or one-day) vulnerability is one for which a patch has been released, meaning defenders have had "at least one day" to apply it. Emil Trägårdh's previous talk at Security Fest focused on patch diffing as a primary method for quickly identifying and exploiting n-days, a technique he demonstrated using his custom tool, patch-diff.

WordPress, as the most widely used Content Management System (CMS), powers over 60% of websites utilizing a CMS, making it a prime target for attackers and a crucial area of expertise for penetration testers. Trägårdh grounds the initial part of his talk in the WordPress ecosystem, using a popular security add-on, Simple Security, installed on over four million websites, as a case study for n-day exploitation. This sets the stage for demonstrating how even well-intentioned security plugins can harbor vulnerabilities that, once patched, become targets for those who haven't updated.

Beyond the clear-cut n-day scenario, Trägårdh introduces a critical "gray area" in vulnerability management: situations where a vulnerability is known or reported, but no official patch is released. This can occur for several reasons, such as the software developer abandoning maintenance, or, more controversially, the vendor disagreeing that an issue constitutes a security vulnerability. He cites a real-world example involving a popular WordPress page builder, Elementor, which had a Remote Code Execution (RCE) vulnerability in a "lockdown" feature. Instead of patching, the vendor chose to update their documentation, effectively reclassifying the RCE as "intended behavior" under specific, user-enabled conditions. This scenario highlights a significant challenge for defenders, as traditional patching strategies are ineffective when no patch exists. Trägårdh illustrates how his custom tool, wp-unfixed, can list such unpatched, unauthenticated vulnerabilities with high CVSS scores, emphasizing that these represent a persistent and often overlooked risk, ripe for exploitation.

Key Findings

▶ Watch: Analyzing the authentication bypass in skip onboarding (3:10)

Emil Trägårdh's talk delivers several profound findings that challenge conventional wisdom in vulnerability research and exploitation:

Firstly, and most importantly, he definitively demonstrates that it is possible to get significantly closer to a zero-day without being the original researcher who discovered the vulnerability. This is achieved through a combination of sophisticated static analysis, understanding common vulnerability patterns, and skilled exploit development. He moves beyond simply identifying known vulnerabilities to actively discovering and exploiting previously undisclosed flaws.

Secondly, Trägårdh showcases the power of custom tooling in accelerating vulnerability discovery and exploitation. His suite of tools – patch diff, AGP (AG for PHP), and hackwp – are central to his methodology. patch diff allows for rapid identification of changes between software versions, crucial for n-day exploitation. AGP provides a powerful static analysis capability, enabling researchers to pinpoint potential vulnerability sinks (like move_uploaded_file for RFI) and trace execution paths, even without a patch to compare against. Hackwp streamlines the exploit development process, allowing for modular construction and chaining of exploits, significantly reducing the time from vulnerability identification to functional exploit.

Thirdly, the talk highlights the prevalence and exploitability of logical flaws in seemingly secure implementations. The Simple Security plugin's authentication bypass stemmed from a validation change that allowed arbitrary user IDs to create sessions. The Storekeeper for WooCommerce zero-day relied on bypassing a cryptographic nonce and a series of image validation checks, demonstrating that developers often overlook the interplay between different security controls or fail to anticipate creative bypass techniques like polyglot files.

Finally, Trägårdh underscores the existence and danger of the "gray area" of vulnerabilities: those that are reported but remain unfixed, or, more critically, those that are discovered but never reported. These vulnerabilities pose a unique challenge as they exist outside the typical patch cycle, requiring defenders to rely on more proactive measures like robust WAFs or in-depth security audits of their own codebases. The live, controlled zero-day demonstration in Storekeeper for WooCommerce serves as a stark illustration of how such unreported vulnerabilities can be identified and exploited by determined adversaries.

Technical Deep Dive

▶ Watch: Understanding session creation via WP set off cookie (4:20)

The talk presents two distinct technical deep dives, each illustrating a different facet of vulnerability exploitation, progressively moving closer to a zero-day.

N-day Exploitation: Simple Security WordPress Plugin

The first deep dive focuses on an n-day vulnerability in the Simple Security WordPress plugin, installed on over four million websites. Trägårdh uses his patch-diff tool to compare a vulnerable version with its patched counterpart. The tool identified only five modified files, making manual inspection feasible. The critical change was found in the skip_onboarding function, which handles a REST API request.

The vulnerable version's skip_onboarding function initially included calls to check_login and get_user, storing their return in a user variable. The patch completely removed this variable assignment and introduced error handling, but critically, it still proceeded to call authenticate_and_redirect using parameters that were now directly controlled by the attacker (user_id and redirect_to). This meant that even if the login_nonce validation failed, the authentication process would still proceed, allowing an attacker to generate authentication cookies for any user ID.

Trägårdh utilized his AGP tool, an ag (silver searcher) wrapper for PHP vulnerability hunting, to trace the authenticate_and_redirect function. He showed that it directly passes the user-controlled user_id to WP_set_auth_cookie, a function responsible for creating authentication cookies. This was a critical finding because it meant an attacker could force the creation of valid authentication sessions for arbitrary user IDs, rather than needing to steal existing sessions.

To exploit this, Trägårdh developed an exploit in his hackwp framework. The exploit sent a POST request to the /wp-json/simple-security/v1/skip-onboarding REST route with three parameters: redirect_to, user_id (set to 1 for the administrator), and login_nonce (set to any, as it was no longer effectively validated). This single request resulted in a successful authentication bypass. To demonstrate the impact, he chained this exploit with hackwp's built-in admin exploit, which leveraged the newly acquired administrator session to upload a PHP shell as a plugin, granting Remote Code Execution (RCE) on the server. The patch for this vulnerability was released six months prior to the talk, making it a clear n-day scenario.

Zero-day Exploitation: Storekeeper for WooCommerce

The second, more advanced deep dive targeted Storekeeper for WooCommerce, an e-commerce plugin, to demonstrate a true (albeit controlled) zero-day. Since no patch existed, patch-diff was inapplicable. Instead, Trägårdh employed AGP for static analysis, searching for common vulnerability sinks. For Remote File Inclusion (RFI) or RCE via file upload, he looked for instances of move_uploaded_file. AGP identified three potential locations, narrowing down to two plausible ones that stored files to the filesystem. The target function was handle_product_image_upload (line 618).

The handle_product_image_upload function contained several security checks:

1. Nonce verification: WP_verify_nonce. Trägårdh noted his high success rate (7-8 out of 10) in bypassing nonce checks when implemented this way.
2. File existence check: $_FILES['file'] must be set.
3. Image validation: getimagesize() is used to ensure the uploaded file is a valid image. This function parses the content, not just the extension.
4. MIME type check: Ensures the MIME type is one of image/jpeg, image/pjpeg, or image/png.

The exploit strategy involved bypassing each of these checks:

• Nonce Bypass: Using AGP -N (for nonce creation), Trägårdh located where the specific nonce for this function was generated. It was found within WP_localize_script inside the enqueue_media_uploader_script function, which is hooked to wp_enqueue_scripts. Crucially, wp_enqueue_scripts runs on almost every page load without authentication. The exploit was designed in two steps: first, a GET request to the index page to scrape the dynamically generated nonce using a regular expression, and then a POST request with the retrieved nonce.

• File Upload Bypass (Image and MIME type): The challenge was to upload a PHP file while satisfying getimagesize() and the MIME type check. Trägårdh employed a polyglot technique. His hackwp framework has an image_wrap utility that embeds arbitrary PHP code into a valid JPEG file header. When this polyglot file (e.g., image.php) is uploaded, getimagesize() successfully validates it as an image due to its header. The MIME type check also passes. However, when the web server later serves this file, it interprets the .php extension and executes the embedded PHP code, achieving RCE. The vulnerability lay in the developer's failure to also check the file extension in addition to content and MIME type.

The exploit used hackwp to send a POST request to the /wp-admin/admin-ajax.php endpoint with the action: storekeeper_handle_product_image_upload. The payload was a polyglot image.php file containing a PHP shell. Upon successful upload, accessing the image.php file directly on the server resulted in a functional web shell, demonstrating full RCE.

Demo / Proof of Concept

▶ Watch: Building the exploit using the hackwp tool (6:00)

The talk featured two distinct and impactful demonstrations, progressively showcasing the journey from an n-day to a controlled zero-day.

The first demonstration centered on the Simple Security WordPress plugin, illustrating an n-day authentication bypass. Trägårdh used his custom tool, hackwp, to execute a pre-built exploit. He configured hackwp to send a POST request to the vulnerable REST API endpoint /wp-json/simple-security/v1/skip-onboarding with a user-controlled user_id (e.g., 1 for the administrator) and an arbitrary login_nonce. The immediate result was a successful authentication bypass, indicated by a 200 OK response. To further prove the impact, he then demonstrated hackwp's ability to chain exploits. By chaining the simple-security exploit with hackwp's admin exploit and a shell payload, he showed how the newly acquired administrator session could be used to upload a PHP shell to the target WordPress instance as a plugin. The shell was then accessed and demonstrated to be fully functional, allowing commands like ls and cat to be executed directly from the terminal, confirming Remote Code Execution (RCE). This part of the demo vividly illustrated the speed and effectiveness of exploiting n-days with automated tooling.

The second, more elaborate demonstration focused on the Storekeeper for WooCommerce plugin, culminating in a live, controlled zero-day exploit. This began by showcasing the nonce bypass technique. Trägårdh configured hackwp to first make a GET request to the target WordPress site's index page. Using a regular expression, hackwp successfully extracted the dynamic nonce value embedded in the page's HTML within an Ajax object. With the nonce in hand, the next step was the file upload vulnerability. The demonstration showed an initial attempt to upload a plain text file, which correctly failed due to the invalid image file error. He then uploaded a real image.jpeg file (a picture of himself in a funny hat), which successfully passed all validation checks, proving that images could be uploaded.

The final, climactic part of the demo involved the polyglot file upload for RCE. Using hackwp's image_wrap functionality, Trägårdh created a image.php file that was a valid JPEG image at its header but contained embedded PHP shell code. This file was then uploaded to the target via the same AJAX endpoint, bypassing the getimagesize() and MIME type checks. Upon successful upload, navigating to the image.php file directly in the browser revealed a working web shell, confirming RCE on the server.

The demonstration concluded with a dramatic "one-button disaster" scenario. Trägårdh introduced another custom tool, a crawler that indexes millions of websites, identifying the software they run. He then showed how this crawler could rapidly identify all domains running the vulnerable Storekeeper for WooCommerce plugin. He then initiated a hackwp command targeting these domains, configured to automatically exploit the zero-day and upload a shell. To prevent any real-world harm, he explicitly stated that all targeted domains resolved to his localhost, ensuring no hospitals or e-commerce stores were affected. This controlled, yet visually impactful, demonstration effectively proved his hypothesis: that one can get extremely close to (and even demonstrate) a zero-day without being the original researcher, especially with advanced custom tooling and a deep understanding of vulnerability patterns.

Defensive Implications

▶ Watch: Successful live demonstration of authentication bypass (8:10)

The insights from Emil Trägårdh's talk carry significant implications for defenders, highlighting areas where current security practices may fall short and offering actionable advice to mitigate risks.

1. Prompt Patching is Paramount for N-days: The Simple Security example underscores the critical importance of applying patches immediately. An n-day vulnerability, once a patch is released, becomes a known attack vector. Attackers, especially with tools like patch-diff, can quickly identify and weaponize these changes. Organizations must have robust patch management policies and systems in place to minimize the window of exposure.

2. Thorough Input Validation for File Uploads: The Storekeeper for WooCommerce zero-day is a stark reminder that file upload mechanisms are frequently vulnerable. Developers must implement multi-layered validation:

• Extension Whitelisting: Do not rely solely on content or MIME type. Explicitly whitelist allowed file extensions (e.g., .jpg, .png, .gif) and disallow executable extensions (.php, .asp, .jsp) in upload directories.
• Content Validation: While getimagesize() is a good start, it's insufficient alone. Be aware of polyglot files that can bypass content checks while still containing malicious code. Consider deeper content analysis or sandboxing uploads.
• MIME Type Verification: While easily bypassed client-side, server-side MIME type checks ($_FILES['file']['type']) provide an initial layer, but should not be the sole defense.
• Storage Location: Uploaded files should ideally be stored outside the web root or in a directory configured to prevent script execution.

3. Robust Nonce Implementation: Nonces, or "numbers used once," are crucial for protecting against Cross-Site Request Forgery (CSRF) and ensuring request legitimacy. However, as Trägårdh demonstrated with his 7-8 out of 10 bypass rate, their implementation is often flawed. Defenders should:

• Ensure nonces are generated securely and are truly unpredictable.
• Verify nonces rigorously on the server-side for every sensitive action.
• Avoid leaking nonces in publicly accessible parts of the application if they are intended for authenticated actions.
• Understand that nonces protect against CSRF but not necessarily against direct exploitation if other authentication or authorization checks are missing.

4. Comprehensive Security Audits for Custom Code: For plugins and custom features, especially in platforms like WordPress, developers must go beyond basic security practices. Static analysis tools (like AGP) can be adapted by internal security teams to proactively search for common vulnerability patterns (e.g., move_uploaded_file, eval, unserialize) in their own codebase. Penetration tests should include deep dives into authentication flows and file handling logic.

5. Web Application Firewalls (WAFs) as a Stopgap: In scenarios where vulnerabilities are known but unfixed (the "gray area"), a WAF can provide a crucial layer of defense. A well-configured WAF can detect and block malicious payloads, including web shells and RCE attempts, even if the underlying application remains vulnerable. However, WAFs are not a panacea and require constant tuning.

6. Vendor Accountability and Maintenance: The Elementor example highlights a concerning trend where vendors may choose to reclassify security issues as features or ignore them. Organizations relying on third-party software should scrutinize vendor responses to reported vulnerabilities and prioritize software from vendors committed to timely and transparent security fixes. For unmaintained software, migration or internal patching become critical considerations.

7. Principle of Least Privilege: Ensure that AJAX endpoints and unauthenticated functionalities have the bare minimum privileges required. Any function accessible without authentication should be treated with extreme caution and subjected to the highest level of security scrutiny.

By integrating these defensive strategies, organizations can significantly enhance their security posture against both known (n-day) and unknown (zero-day or gray-area) vulnerabilities, moving closer to a proactive, rather than purely reactive, security model.

Key Takeaways

• N-day vulnerabilities are a persistent and easily exploitable threat if patches are not applied immediately. Tools like patch-diff enable rapid weaponization of newly disclosed vulnerabilities.
• Static analysis tools like AGP are powerful for proactive vulnerability research, allowing security professionals to identify common vulnerability patterns (e.g., move_uploaded_file for RFI) and trace execution flows even without a patch.
• Nonce implementations are frequently flawed and bypassable, often due to predictable generation, leakage, or insufficient server-side validation, making them a common target for attackers.
• File upload vulnerabilities can be bypassed with polyglot files if developers rely solely on content-based checks (like getimagesize()) without also validating file extensions against a strict whitelist.
• It is possible to get extremely close to (or even demonstrate a controlled) a zero-day without being the original researcher, primarily through advanced static analysis, understanding attack patterns, and sophisticated exploit development.
• The "gray area" of unfixed, reported vulnerabilities poses a significant risk, as traditional patching strategies are ineffective, requiring defenders to rely on other controls like WAFs or internal code audits.
• Custom tooling like hackwp can dramatically accelerate exploit development, enabling chaining of vulnerabilities and automated payload delivery, reducing the time from discovery to exploitation.

About the Speaker(s)

Emil Trägårdh is a Swedish ethical hacker known for his expertise in web application security. He is a returning speaker at Security Fest, having presented previously on the topic of patch diffing. Trägårdh is also the creator of several specialized security tools designed to aid in vulnerability research and exploitation, including patch-diff (for comparing software versions), AGP (a PHP vulnerability hunting tool built on ag the silver searcher), hackwp (a framework for WordPress penetration testing and exploit development), and a crawler tool for gathering intelligence on websites and their software. His work consistently focuses on pushing the boundaries of what is achievable in vulnerability discovery without being the original researcher, emphasizing practical methodologies and custom automation.