05 Oct

Arbitrary File Viewing Vulnerability in WP Post Popup

Back in August through our proactively monitoring for evidence of some high risk vulnerabilities when changes are made to WordPress plugins we found that the plugin WP Post Popup contained an arbitrary file viewing vulnerability. That was subsequently fixed. Through that same monitoring we found that the vulnerability had returned to the plugin.

The only difference from last time is that file the vulnerability was now in is named /public/partials/wp-post-modal-public-proxy.php.

In that file the first code was:

12
13
if ( isset( $_GET['url'] ) ) {
	echo file_get_contents( $_GET['url'] );
That code takes the value of the GET input “url”, passes it to the function file_get_contents(), and echo’s the result. So with that you can view the contents of any file on the website. Hackers would normally exploit that to the view the contents of the WordPress configuration file, wp-config.php file.

In addition to being able to be used for arbitrary file viewing, the vulnerability could be used for cross-site scripting (XSS) since file_get_contents() can also get the contents of URLs “if the fopen wrappers have been enabled”.

After we notified the developer they removed that file. It was removed 13 minutes after version 2.1.2 was released. So there was a small window for those installing or updating the plugin to version 2.1.2 to have gotten it with that version.  If you are using that version to be safe, check if it contains that file and if it does then remove it.

Proof of Concept

The following proof of concept will display the contents of the WordPress configuration file, wp-config.php.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-content/plugins/wp-post-modal/public/partials/wp-post-modal-public-proxy.php?url=../../../../../wp-config.php

Timeline

  • October 5, 2017 – Developer notified.
  • October 5, 2017 – Vulnerability resolved.
  • October 5, 2017 – Developer responds.
05 Oct

Vulnerability Details: Arbitrary File Upload Vulnerability in mb.miniAudioPlayer

From time to time a vulnerability is fixed in a plugin without the discoverer putting out a report on the vulnerability and we will put out a post detailing the vulnerability so that we can provide our customers with more complete information on the vulnerability.

Recently we had a request on this website for the following URL:

/wp-content/plugins/wp-miniaudioplayer/map_download.php?fileurl=../../../wp-config.php

That looked like an attempt to exploit an arbitrary file viewing vulnerability in the plugin  mb.miniAudioPlayer. In looking for any previously released details on that type of vulnerability we found a vague disclosure from November of 2015.

In looking back at old versions we found that as of version 1.2.7 the code in the file map_download.php was the following:

5
6
7
8
9
10
11
12
13
$file_name = $_GET["filename"];
$file_url = $_GET["fileurl"];
 
header("Content-Description: File Transfer");
header('Content-type: application/mp3');
header("Content-Transfer-Encoding: Binary");
header("Content-disposition: attachment; filename=\"".$file_name."\"");
readfile($file_url);
exit;

That code will cause the contents of the file specified by the GET input “fileurl” to be downloaded.

In the subsequent version, which was released in April of 2013, the code in the file was changed. The extension of the file specified is determined:

9
10
11
12
13
$file_extension = strtolower (substr (strrchr ($filename, '.'), 1)) ;
 
 
//This will set the Content-Type to the appropriate setting for the file
switch ($file_extension)

And if files with certain extensions are being requested the code stops running:

68
69
70
71
72
case 'php':
case 'htm':
case 'html':
case 'txt':
	die ('<b>Cannot be used for '. $file_extension .' files!</b>') ;

Subsequent versions added additional restrictions.

Proof of Concept

The following proof of concept will download the contents of the WordPress configuration file, wp-config.php.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-content/plugins/wp-miniaudioplayer/map_download.php?fileurl=../../../wp-config.php
11 Aug

Arbitrary File Viewing Vulnerability in WP Post Popup

We recently started proactively monitoring for evidence of some high risk vulnerabilities when changes are made to WordPress plugins and if we had more customers we could expand the proactive monitoring to more types of vulnerabilities. For the first time we have found an arbitrary file viewing vulnerability through this, which is  a type of vulnerability that is up there with the most likely to have exploit attempts. What is concerning about the vulnerability we found in the plugin WP Post Popup is how obvious the issue is and yet it had yet to be noticed.

In the file /public/includes/proxy.php the first code was:

15
16
if (isset($_GET['url'])) {
    echo file_get_contents($_GET['url']);

That code takes the value of the GET input “url”, passes it to the function file_get_contents(), and echo’s the result. So with that you can view the contents of any file on the website. Hackers would normally exploit that to the view the contents of the WordPress configuration file, wp-config.php file.

In addition to being able to be used for arbitrary file viewing, the vulnerability could be used for cross-site scripting (XSS) since file_get_contents() can also get the contents of URLs ” if the fopen wrappers have been enabled”.

We notified the developer and several hours later the vulnerability was resolved by removing that file and changing how the relevant functionality is handled.

Proof of Concept

The following proof of concept will display the contents of the WordPress configuration file, wp-config.php.

Make sure to replace “[path to WordPress]” with the location of WordPress.

http://[path to WordPress]/wp-content/plugins/wp-post-modal/public/includes/proxy.php?url=../../../../../wp-config.php

Timeline

  • August 10, 2017 – Developer notified.
  • August 10, 2017 – Developer responds.
  • August 10, 2017 – Version 2.0.1 released, which fixes vulnerability.
14 Jun

Vulnerability Details: File Manager Access Vulnerability in WP File Manager

From time to time a vulnerability is fixed in a plugin without the discoverer putting out a report on the vulnerability and we will put out a post detailing the vulnerability so that we can provide our customers with more complete information on the vulnerability.

When it comes to functionality in plugins that has high potential for abuse, you would hope that developers would be ...


To read the rest of this post you need to have an active account with our service.

For existing customers, please log in to your account to view the rest of the post.

If you are not currently a customer, when you sign up now you can try the service for free for the first month (there are a lot of other reason that you will want to sign up beyond access to posts like this one).

If you are a security researcher please contact us to get free access to all of our Vulnerability Details posts.

27 Feb

Vulnerability Details: Arbitrary File Viewing Vulnerability in WP Hide & Security Enhancer

From time to time vulnerabilities are fixed in plugin without someone putting out a report on the vulnerability and we will put out a post detailing the vulnerability. While putting out the details of the vulnerability increases the chances of it being exploited, it also can help to identify vulnerabilities that haven’t been fully fixed (in some cases not fixed at all) and help to identify additional vulnerabilities in ...


To read the rest of this post you need to have an active account with our service.

For existing customers, please log in to your account to view the rest of the post.

If you are not currently a customer, when you sign up now you can try the service for free for the first month (there are a lot of other reason that you will want to sign up beyond access to posts like this one).

If you are a security researcher please contact us to get free access to all of our Vulnerability Details posts.

11 Oct

Vulnerability Details: Arbitrary File Viewing Vulnerability in Simply Static

From time to time vulnerabilities are fixed in plugin without someone putting out a report on the vulnerability and we will put out a post detailing the vulnerability. While putting out the details of the vulnerability increases the chances of it being exploited, it also can help to identify vulnerabilities that haven’t been fully fixed (in some cases not fixed at all) and help to identify additional vulnerabilites ...


To read the rest of this post you need to have an active account with our service.

For existing customers, please log in to your account to view the rest of the post.

If you are not currently a customer, when you sign up now you can try the service for free for the first month (there are a lot of other reason that you will want to sign up beyond access to posts like this one).

If you are a security researcher please contact us to get free access to all of our Vulnerability Details posts.

22 Jun

Old Vulnerability Report: Arbitrary File Viewing Vulnerability in Cherry Plugin

One of the things that we do to keep track of the  plugin vulnerabilities out there is to monitor hacking attempts on our websites. That sometimes leads us to finding what looks to be exploitation of vulnerabilities that a hacker has just discovered. In other cases it shows really old vulnerabilities that hackers are still trying to exploit. We have recently had some attempts to exploit a couple of vulnerabilities in older versions of the plugin Cherry Plugin. One was an arbitrary file upload vulnerability mentioned here and the other was an arbitrary file viewing vulnerability that we couldn’t find any prior mention of.

In version 1.2.6 and below the file /admin/import-export/download-content.php will serve up the contents of any file requested. It looks like that functionality was intended to be only accessible by admins, but there were no restrictions in place to prevent anyone else from accessing it.

Proof of Concept

The following proof of concept will download the website’s wp-config.php file.

Make sure to replace “[path to WordPress]” with the location of WordPress:

http://[path to WordPress]/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php?file=../../../../../wp-config.php