Hello list!

I want to inform you about vulnerability in Contact Form 7 plugin for 
WordPress.

This is Code Execution via Arbitrary File Uploading vulnerability.

-------------------------
Affected products:
-------------------------

Vulnerable are Contact Form 7 3.5.2 and previous versions. After my 
informing developer released version 3.5.3 with a fix.

-------------------------
Affected vendors:
-------------------------

Contact Form 7
http://contactform7.com

----------
Details:
----------

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to upload phtml 
(on web servers with PHP) or asp/aspx (on IIS) files.

The attack can be made as by user with admin rights (to make appropriate 
contact form with uploader tag) and by unauthenticated user, if there is 
already appropriate contact form at web site (made by unsuspicious admin).

For the first scenario the attack process will be the next.

Attacker with admin access add uploader tag into contact form at the site 
and use it for CE via AFU attack.

There must be uploader tag in contact form and it's needed to set allowed 
extension to it (because besides the list of forbidden extensions, the 
plugin also has the list of allowed extensions and there are no scripts 
among them).

[file file-423 filetypes:phtml]

The files are uploaded into folder: 
http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny 
from all).

It can be bypassed at using of other web servers besides Apache (where 
.htaccess is ignored), or at Apache it's possible to use vulnerabilities in 
WP for file deletion, or via LFI vulnerability to include a file from this 
folder.

------------
Timeline:
------------ 

2013.09.28 - announced at my site.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about this and other 
vulnerabilities in CF7.
2013.10.09 - plugin version 3.5.3 was released.
2013.11.21 - disclosed at my site (http://websecurity.com.ua/6799/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua