what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Contact Form 7 3.5.3 Shell Upload

WordPress Contact Form 7 3.5.3 Shell Upload
Posted Jan 31, 2014
Authored by MustLive

WordPress Contact Form 7 versions 3.5.3 and below suffer from a remote shell upload vulnerability.

tags | advisory, remote, shell
SHA-256 | a9b2be4594160bcca7766b6d73934f9f3c1a86a30c2cc6b9f5ee48d581468d96

WordPress Contact Form 7 3.5.3 Shell Upload

Change Mirror Download
Hello list!

I want to inform you about vulnerabilities in Contact Form 7 plugin for
WordPress.

These are Code Execution via Arbitrary File Uploading vulnerabilities (two
attack vectors). This is addition to previous Code Execution vulnerability
in Contact Form 7 (http://seclists.org/fulldisclosure/2013/Nov/182).

-------------------------
Affected products:
-------------------------

Vulnerable are Contact Form 7 3.5.3 and previous versions. After my
informing developer fixed previous hole in version 3.5.3, but refused to fix
these two attack vectors, so all versions of Contact Form 7 are vulnerable.

The attacks are possible only on earlier versions of WordPress, but in the
last versions the WP itself blocks attacks via semicolon and double
extensions. So developer doesn't want to make the protection in his plugin
itself (the WP must do the work) and he doesn't take into account
possibilities that somebody could run plugin on older versions of engine or
in the future versions of WP the protection code could be changed. So I
recommend to use this plugin (since 3.5.3) only with the last versions of
WordPress.

-------------------------
Affected vendors:
-------------------------

Contact Form 7
http://contactform7.com

----------
Details:
----------

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to use bypass
methods for IIS and Apache. It's possible to use semicolon in file name
(1.asp;.txt) on IIS or double extension (1.php.txt) on Apache.

The attack can be made as by user with admin rights (to make contact form
with uploader tag), as by unauthenticated user, if there is already contact
form with uploader tag at web site - with default configuration (unlike
previous CE hole).

There must be uploader tag in contact form.

[file file-423]

The files are uploaded into folder:
http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny
from all).

It can be bypassed at using of other web servers besides Apache (where
.htaccess is ignored), or at Apache it's possible to use vulnerabilities in
WP for file deletion, or via LFI vulnerability to include a file from this
folder.

------------
Timeline:
------------

2013.09.28 - announced at my site about the first hole.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about different vulnerabilities
in CF7.
2013.10.09 - plugin version 3.5.3 was released (with fix for the first
hole).
2013.10.09 - announced at my site about new holes.
2014.01.28 - disclosed at my site (http://websecurity.com.ua/6806/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    16 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close