exploit the possibilities

WordPress W3 Total Cache 0.9.4.1 Race Condition

WordPress W3 Total Cache 0.9.4.1 Race Condition
Posted Nov 11, 2016
Authored by Securify B.V., Sipke Mellema

An information disclosure vulnerability was found in the W3 Total Cache plugin. This issue allows an attacker to hijack sensitive information, such as the administrator's session cookie. Exploiting the vulnerability is possible during a short period of time when an administrator submits the support form. Version 0.9.4.1 is affected.

tags | exploit, info disclosure
MD5 | f4944a81070ec53fc3f9cc16169fd2f0

WordPress W3 Total Cache 0.9.4.1 Race Condition

Change Mirror Download
------------------------------------------------------------------------
Information disclosure race condition in W3 Total Cache WordPress Plugin
------------------------------------------------------------------------
Sipke Mellema, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
An information disclosure vulnerability was found in the W3 Total Cache
plugin. This issue allows an attacker to hijack sensitive information,
such as the administrator's session cookie. Exploiting the vulnerability
is possible during a short period of time when an administrator submits
the support form.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0002

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the W3 Total Cache WordPress
Plugin version 0.9.4.1.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in W3 Total Cache version 0.9.5.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/information_disclosure_race_condition_in_w3_total_cache_wordpress_plugin.html

The issue exists in the file /lib/W3/AdminActions/SupportActionsAdmin.php in the method action_support_request. This method handles the request when an Administrator submits the support form. When the support form is submitted, the code will create temporary files in a publicly readable directory. These files will be deleted after performing a POST request to the W3 Total Cache support URL (W3TC_SUPPORT_REQUEST_URL).

Three files are created when submitting a support request. The file containing the most sensitive information is php_info.html, which contains the output of phpinfo(). The output contains all information entered in the support form, and the administrator's cookies.

/**
* Attach phpinfo
*/
ob_start();
phpinfo();
$php_info = ob_get_contents();
ob_end_clean();
$php_info_path = W3TC_CACHE_TMP_DIR . '/php_info.html';
if (@file_put_contents($php_info_path, $php_info)) {
$attachments[] = $php_info_path;
[..]
$response = wp_remote_post(W3TC_SUPPORT_REQUEST_URL, array('body' => $post, ..
[..]
@unlink($attachment);

The code also creates the files server_info.txt and self_test.html, that disclose information about the server.

During the timeframe between the creation and removal of php_info.html, the file can be downloaded. This timeframe will depend on the time it takes to send the form to the support URL, which can take multiple seconds. Time frames up to 10 seconds were observed during tests.

The support form allows users to provide personal data and to attach files. Also, there is an Additional Information section that asks for WordPress and SSH credentials. All this information can be publicly read when submitting the form, allowing an attacker to hijack an administrator's account or in some cases the webserver.

This issue can be exploited by making an administrator submit a support ticket and requesting the files. It's also possible to probe a server for the files every few seconds until a support ticket is submitted.
Proof of Concept


Have an administrator submit a support ticket. Right after the administrator clicks Submit request, download the following file from the server:

<wordpress server>/wp-content/cache/tmp/php_info.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

June 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    1 Files
  • 2
    Jun 2nd
    2 Files
  • 3
    Jun 3rd
    19 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    15 Files
  • 6
    Jun 6th
    12 Files
  • 7
    Jun 7th
    11 Files
  • 8
    Jun 8th
    1 Files
  • 9
    Jun 9th
    1 Files
  • 10
    Jun 10th
    15 Files
  • 11
    Jun 11th
    15 Files
  • 12
    Jun 12th
    15 Files
  • 13
    Jun 13th
    8 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    2 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    18 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    22 Files
  • 20
    Jun 20th
    14 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close