exploit the possibilities

WordPress Contact Form 7 3.5.3 Shell Upload

WordPress Contact Form 7 3.5.3 Shell Upload
Posted Jan 31, 2014
Authored by MustLive

WordPress Contact Form 7 versions 3.5.3 and below suffer from a remote shell upload vulnerability.

tags | advisory, remote, shell
MD5 | 31d061b82323d1b6d271c09a577543ae

WordPress Contact Form 7 3.5.3 Shell Upload

Change Mirror Download
Hello list!

I want to inform you about vulnerabilities in Contact Form 7 plugin for
WordPress.

These are Code Execution via Arbitrary File Uploading vulnerabilities (two
attack vectors). This is addition to previous Code Execution vulnerability
in Contact Form 7 (http://seclists.org/fulldisclosure/2013/Nov/182).

-------------------------
Affected products:
-------------------------

Vulnerable are Contact Form 7 3.5.3 and previous versions. After my
informing developer fixed previous hole in version 3.5.3, but refused to fix
these two attack vectors, so all versions of Contact Form 7 are vulnerable.

The attacks are possible only on earlier versions of WordPress, but in the
last versions the WP itself blocks attacks via semicolon and double
extensions. So developer doesn't want to make the protection in his plugin
itself (the WP must do the work) and he doesn't take into account
possibilities that somebody could run plugin on older versions of engine or
in the future versions of WP the protection code could be changed. So I
recommend to use this plugin (since 3.5.3) only with the last versions of
WordPress.

-------------------------
Affected vendors:
-------------------------

Contact Form 7
http://contactform7.com

----------
Details:
----------

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to use bypass
methods for IIS and Apache. It's possible to use semicolon in file name
(1.asp;.txt) on IIS or double extension (1.php.txt) on Apache.

The attack can be made as by user with admin rights (to make contact form
with uploader tag), as by unauthenticated user, if there is already contact
form with uploader tag at web site - with default configuration (unlike
previous CE hole).

There must be uploader tag in contact form.

[file file-423]

The files are uploaded into folder:
http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny
from all).

It can be bypassed at using of other web servers besides Apache (where
.htaccess is ignored), or at Apache it's possible to use vulnerabilities in
WP for file deletion, or via LFI vulnerability to include a file from this
folder.

------------
Timeline:
------------

2013.09.28 - announced at my site about the first hole.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about different vulnerabilities
in CF7.
2013.10.09 - plugin version 3.5.3 was released (with fix for the first
hole).
2013.10.09 - announced at my site about new holes.
2014.01.28 - disclosed at my site (http://websecurity.com.ua/6806/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    11 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    2 Files
  • 19
    Aug 19th
    18 Files
  • 20
    Aug 20th
    19 Files
  • 21
    Aug 21st
    17 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close