full-disclosure - Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7 (WordPress plugin)

Open Source and information security mailing list archives

Message-ID: <5360F1AE.2020903@dxw.com>
Date: Wed, 30 Apr 2014 13:50:54 +0100
From: Harry Metcalfe <harry@....com>
To: Dave Warren <davew@...eahit.com>, Illwill <illwill@...mob.org>, 
	fulldisclosure@...lists.org
Subject: Re: [FD] Arbitrary code execution by admins in File Gallery 1.7.7
 (WordPress plugin)

Hi Illwill,

> What circumstance would a WordPress admin not usually have this kind of access anyhow?
As Dave said, there are various levels of administrator in WordPress. 
But our perspective on these issues is just that a WordPress 
administrator is not necessarily also a server administrator. Plenty of 
our clients have staff who are administrators but who certainly do not 
have anything equivalent to root server access or permissions. There are 
also plenty of multisite installations of WordPress where the 
administrators of individual blogs have no permissions on other blogs, 
or on the main site.

> Why the delay in discovery til reporting?
My fault - a colleague wrote the report, and I didn't notice it at the time.

Harry

> On 2014-04-29 05:13, Illwill wrote:
>> What circumstance would a WordPress admin not usually have this kind 
>> of access anyhow?
>
> Although it's rarely used, WordPress does have the capability to 
> support multiple levels of administrators, in which case one may have 
> access to an already installed plugin, but not to install their own.
>
> The same may be true if this plugin were installed in multiuser mode, 
> although I haven't kept up on what is permitted in multiuser mode, or 
> whether this plugin works in multiuser mode or not.
>

-- 
Harry Metcalfe
07790 559 876
@harrym

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives