[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150721024539.C702A8BC082@smtpvmsrv1.mitre.org>
Date: Mon, 20 Jul 2015 22:45:39 -0400 (EDT)
From: cve-assign@...re.org
To: larry0@...com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Remote file download vulnerability in Wordpress Plugin image-export v1.1
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Download Site: https://wordpress.org/plugins/image-export
> Vendor: www.1efthander.com
> Vendor Contact: https://twitter.com/1eftHander
[ https://web.archive.org/web/20150425215252/https://wordpress.org/plugins/image-export/
says "Active Installs: 20+" and
https://plugins.trac.wordpress.org/changeset/1112244 says
"03/13/15 ... adding image-export by 1eftHander." ]
> if ( isset( $_REQUEST['file'] ) && !empty( $_REQUEST['file'] ) ) {
> $file = $_GET['file'];
>
> header( 'Content-Type: application/zip' );
> header( 'Content-Disposition: attachment; filename="' . $file . '"' );
> readfile( $file );
> 8 unlink( $file );
> Exploit Code:
> curl http://example.com/wp-content/plugins/image-export/download.php?file=/etc/passwd
> The code in file download.php doesn't do any checking that the user is
> requesting files from the uploaded images directory only. And line 8
> attempts to unlink the file after being downloaded. This script could
> be used to delete files out of the wordpress directory if file
> permissions allow.
Our interpretation is that there is only one security problem. The
download.php script should only be operating on ZIP files created by
the image-export.php script (see the
http://plugins.svn.wordpress.org/image-export/trunk/ directory), but
does not enforce that in any way. The latter script has
"define( 'DOWNLOAD_PATH', dirname( __FILE__ ) );" near the top. There
doesn't seem to be any evidence that either reading other files in the
DOWNLOAD_PATH directory, or deleting other files in the DOWNLOAD_PATH
directory, is supported behavior. This is not necessarily about
directory traversal. The only file that should be either read or
deleted is an images*.zip file. Deleting this file is apparently
intentional because there's no need to continue storing both the
individual files and the ZIP archive.
We don't think there should be two CVE IDs based on an argument such
as "reading files is probably important only with directory traversal,
but deleting files is probably important even without directory
traversal."
Use CVE-2015-5609 for the vulnerability in which download.php proceeds
with readfile and unlink without verifying that the pathname is
image-export's own pathname for its own ZIP file.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVrbG9AAoJEKllVAevmvmsOGYH/0If9ZkZGz3/Y8w2Zc4FgShw
4AbcQt/sXiHufN0wuq2RbG+iq5Fztrq4hmH4OT7SqA6tEgx2ArKe58q3w0Lg34Mp
as4iv8D7RPs70xFZdTuByuupOJPP1mmP180WukM/ueuuWoBxxZCbjblf1C2cLozL
u7j7v5ROGbM6yCv/lDDc412ahp0/LdyjUMR5f99Ap1+i/rRNlH62tvt2746jvUqV
NammFvi447WhNpr3uCH+foFzsii9rZe2g7dklpXuOY1yi8Iha3hC1aOjO+710xV4
J6A0VF63E0QHrsEZYjbF8jqA0GL5V3fqdVVUWfDhu4ttwyqSvCzxgZAx7zxNRIU=
=A5bx
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
