Arbitrary File Upload Vulnerability in Gravity Forms

Gravity Forms versions up to and including 3.0.2 contain a critical vulnerability in the GFAsyncUpload::upload() function. The flaw stems from insufficient validation of multi-file upload chunk state, allowing the reuse of public form state URL hashes as chunk continuation hashes. Attackers can leverage this to influence the temporary filename used during the upload process.

When a public-facing form includes a File Upload field with the "Multiple Files" option enabled, an unauthenticated attacker can upload files to the plugin's temporary storage directory. On web servers that do not honor .htaccess files (e.g., NGINX), this allows for the upload of executable PHP code, resulting in remote code execution. In environments where the plugin successfully places a .htaccess file to block PHP execution, the vulnerability still allows for stored cross-site scripting (XSS) if an attacker uploads malicious HTML files that are subsequently accessed by users.

Attack Chain

1. Attacker identifies a WordPress site running a vulnerable version of Gravity Forms (<= 3.0.2).
2. Attacker discovers a public form containing a File Upload field with "Multiple Files" enabled.
3. Attacker crafts a malicious payload (e.g., PHP polyglot or malicious HTML).
4. Attacker performs a multipart file upload request to the GFAsyncUpload::upload() endpoint.
5. Attacker manipulates the chunk continuation hash to control the destination filename in the temporary upload directory.
6. Server processes the request and writes the malicious file to the storage directory.
7. Attacker navigates to the file URL to trigger execution (RCE) or XSS.

Impact

Successful exploitation can lead to full remote code execution on the underlying server if it does not properly restrict execution in the temporary directory. In secondary scenarios, attackers can achieve stored XSS, allowing for session hijacking or further compromise of authenticated administrative users.

Recommendation

Prioritized actions for the detection engineering and security operations teams:

• Upgrade the Gravity Forms plugin to the latest patched version immediately.
• Implement a web application firewall (WAF) rule to block POST requests to Gravity Forms upload endpoints that contain suspicious filename extensions (e.g., .php, .html, .js) if upgrading is delayed.
• Audit the temporary upload directory for unauthorized files, particularly those with executable extensions.
• Ensure the web server configuration explicitly denies execution of files in the Gravity Forms temporary upload directory.