full-disclosure - Code Execution vulnerability in Contact Form 7 for WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 22 Nov 2013 21:25:51 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Code Execution vulnerability in Contact Form 7
	for WordPress

Hello list!

I want to inform you about vulnerability in Contact Form 7 plugin for 
WordPress.

This is Code Execution via Arbitrary File Uploading vulnerability.

-------------------------
Affected products:
-------------------------

Vulnerable are Contact Form 7 3.5.2 and previous versions. After my 
informing developer released version 3.5.3 with a fix.

-------------------------
Affected vendors:
-------------------------

Contact Form 7
http://contactform7.com

----------
Details:
----------

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to upload phtml 
(on web servers with PHP) or asp/aspx (on IIS) files.

The attack can be made as by user with admin rights (to make appropriate 
contact form with uploader tag) and by unauthenticated user, if there is 
already appropriate contact form at web site (made by unsuspicious admin).

For the first scenario the attack process will be the next.

Attacker with admin access add uploader tag into contact form at the site 
and use it for CE via AFU attack.

There must be uploader tag in contact form and it's needed to set allowed 
extension to it (because besides the list of forbidden extensions, the 
plugin also has the list of allowed extensions and there are no scripts 
among them).

[file file-423 filetypes:phtml]

The files are uploaded into folder: 
http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny 
from all).

It can be bypassed at using of other web servers besides Apache (where 
.htaccess is ignored), or at Apache it's possible to use vulnerabilities in 
WP for file deletion, or via LFI vulnerability to include a file from this 
folder.

------------
Timeline:
------------ 

2013.09.28 - announced at my site.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about this and other 
vulnerabilities in CF7.
2013.10.09 - plugin version 3.5.3 was released.
2013.11.21 - disclosed at my site (http://websecurity.com.ua/6799/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/