lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Apr 2018 14:11:46 +0000 From: dxw Security <harry@....com> To: fulldisclosure@...lists.org Subject: [FD] WP Image Zoom allows anybody to cause denial of service (WordPress plugin) Details ================ Software: WP Image Zoom Version: 1.23 Homepage: http://wordpress.org/plugins/wp-image-zoooom/ Advisory report: https://advisories.dxw.com/advisories/wp-image-zoom-dos/ CVE: Awaiting assignment CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C) Description ================ WP Image Zoom allows anybody to cause denial of service Vulnerability ================ WP Image Zoom includes an AJAX action which allows any logged in user to set any option to “1”. This means that any logged in user can cause a denial of service for all WP URLs by setting the “template” option to “1”. Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service. Proof of concept ================ Press the submit button in the following HTML snippet: <form action=\"http://localhost/wp-admin/admin-ajax.php\" method=\"POST\"> <input type=\"text\" name=\"action\" value=\"iz_dismiss\"> <input type=\"text\" name=\"option\" value=\"template\"> <input type=\"submit\"> </form> This will set the template option to 1 causing fatal errors for any WordPress URL. In a real attack the form could be set to autosubmit so no user interaction is required except for following a link. Mitigations ================ Upgrade to version 1.24 or later. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/ Please contact us on security@....com to acknowledge this report if you received it via a third party (for example, plugins@...dpress.org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2018-03-20: Discovered 2018-03-27: Reported to author via https://www.silkypress.com/contact/ 2018-03-27: Vendor responded 2018-03-29: Vendor reported issue fixed in version 1.24 Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists