full-disclosure - [FD] WP Image Zoom allows anybody to cause denial of service (WordPress plugin)

Open Source and information security mailing list archives

Message-ID: <3f14250e25b9ae1a5de2342792338b41@advisories.dxw.com>
Date: Tue, 10 Apr 2018 14:11:46 +0000
From: dxw Security <harry@....com>
To: fulldisclosure@...lists.org
Subject: [FD] WP Image Zoom allows anybody to cause denial of service
	(WordPress plugin)

Details
================
Software: WP Image Zoom
Version: 1.23
Homepage: http://wordpress.org/plugins/wp-image-zoooom/
Advisory report: https://advisories.dxw.com/advisories/wp-image-zoom-dos/
CVE: Awaiting assignment
CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C)

Description
================
WP Image Zoom allows anybody to cause denial of service

Vulnerability
================
WP Image Zoom includes an AJAX action which allows any logged in user to set any option to “1”. This means that any logged in user can cause a denial of service for all WP URLs by setting the “template” option to “1”.
Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service.

Proof of concept
================
Press the submit button in the following HTML snippet:
<form action=\"http://localhost/wp-admin/admin-ajax.php\" method=\"POST\">
 <input type=\"text\" name=\"action\" value=\"iz_dismiss\">
 <input type=\"text\" name=\"option\" value=\"template\">
 <input type=\"submit\">
</form>
This will set the template option to 1 causing fatal errors for any WordPress URL.
In a real attack the form could be set to autosubmit so no user interaction is required except for following a link.

Mitigations
================
Upgrade to version 1.24 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@....com to acknowledge this report if you received it via a third party (for example, plugins@...dpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2018-03-20: Discovered
2018-03-27: Reported to author via https://www.silkypress.com/contact/
2018-03-27: Vendor responded
2018-03-29: Vendor reported issue fixed in version 1.24

Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives