full-disclosure - Vulnerabilities in Contact Form 7 for WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <00a101cf1ecf$514fc6c0$9b7a6fd5@pc>
Date: Fri, 31 Jan 2014 23:57:00 +0200
From: "MustLive" <mustlive@...security.com.ua>
To: <submissions@...ketstormsecurity.org>, <full-disclosure@...ts.grok.org.uk>
Subject: Vulnerabilities in Contact Form 7 for WordPress

Hello list!

I want to inform you about vulnerabilities in Contact Form 7 plugin for
WordPress.

These are Code Execution via Arbitrary File Uploading vulnerabilities (two
attack vectors). This is addition to previous Code Execution vulnerability
in Contact Form 7 (http://seclists.org/fulldisclosure/2013/Nov/182).

-------------------------
Affected products:
-------------------------

Vulnerable are Contact Form 7 3.5.3 and previous versions. After my
informing developer fixed previous hole in version 3.5.3, but refused to fix
these two attack vectors, so all versions of Contact Form 7 are vulnerable.

The attacks are possible only on earlier versions of WordPress, but in the
last versions the WP itself blocks attacks via semicolon and double
extensions. So developer doesn't want to make the protection in his plugin
itself (the WP must do the work) and he doesn't take into account
possibilities that somebody could run plugin on older versions of engine or
in the future versions of WP the protection code could be changed. So I
recommend to use this plugin (since 3.5.3) only with the last versions of
WordPress.

-------------------------
Affected vendors:
-------------------------

Contact Form 7
http://contactform7.com

----------
Details:
----------

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to use bypass
methods for IIS and Apache. It's possible to use semicolon in file name
(1.asp;.txt) on IIS or double extension (1.php.txt) on Apache.

The attack can be made as by user with admin rights (to make contact form
with uploader tag), as by unauthenticated user, if there is already contact
form with uploader tag at web site - with default configuration (unlike
previous CE hole).

There must be uploader tag in contact form.

[file file-423]

The files are uploaded into folder:
http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny
from all).

It can be bypassed at using of other web servers besides Apache (where
.htaccess is ignored), or at Apache it's possible to use vulnerabilities in
WP for file deletion, or via LFI vulnerability to include a file from this
folder.

------------
Timeline:
------------ 

2013.09.28 - announced at my site about the first hole.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about different vulnerabilities
in CF7.
2013.10.09 - plugin version 3.5.3 was released (with fix for the first
hole).
2013.10.09 - announced at my site about new holes.
2014.01.28 - disclosed at my site (http://websecurity.com.ua/6806/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/