what you don't know can hurt you

WordPress W3 Total Cache 0.9.4.1 Race Condition

WordPress W3 Total Cache 0.9.4.1 Race Condition
Posted Nov 11, 2016
Authored by Securify B.V., Sipke Mellema

An information disclosure vulnerability was found in the W3 Total Cache plugin. This issue allows an attacker to hijack sensitive information, such as the administrator's session cookie. Exploiting the vulnerability is possible during a short period of time when an administrator submits the support form. Version 0.9.4.1 is affected.

tags | exploit, info disclosure
MD5 | f4944a81070ec53fc3f9cc16169fd2f0

WordPress W3 Total Cache 0.9.4.1 Race Condition

Change Mirror Download
------------------------------------------------------------------------
Information disclosure race condition in W3 Total Cache WordPress Plugin
------------------------------------------------------------------------
Sipke Mellema, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
An information disclosure vulnerability was found in the W3 Total Cache
plugin. This issue allows an attacker to hijack sensitive information,
such as the administrator's session cookie. Exploiting the vulnerability
is possible during a short period of time when an administrator submits
the support form.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0002

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the W3 Total Cache WordPress
Plugin version 0.9.4.1.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in W3 Total Cache version 0.9.5.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/information_disclosure_race_condition_in_w3_total_cache_wordpress_plugin.html

The issue exists in the file /lib/W3/AdminActions/SupportActionsAdmin.php in the method action_support_request. This method handles the request when an Administrator submits the support form. When the support form is submitted, the code will create temporary files in a publicly readable directory. These files will be deleted after performing a POST request to the W3 Total Cache support URL (W3TC_SUPPORT_REQUEST_URL).

Three files are created when submitting a support request. The file containing the most sensitive information is php_info.html, which contains the output of phpinfo(). The output contains all information entered in the support form, and the administrator's cookies.

/**
* Attach phpinfo
*/
ob_start();
phpinfo();
$php_info = ob_get_contents();
ob_end_clean();
$php_info_path = W3TC_CACHE_TMP_DIR . '/php_info.html';
if (@file_put_contents($php_info_path, $php_info)) {
$attachments[] = $php_info_path;
[..]
$response = wp_remote_post(W3TC_SUPPORT_REQUEST_URL, array('body' => $post, ..
[..]
@unlink($attachment);

The code also creates the files server_info.txt and self_test.html, that disclose information about the server.

During the timeframe between the creation and removal of php_info.html, the file can be downloaded. This timeframe will depend on the time it takes to send the form to the support URL, which can take multiple seconds. Time frames up to 10 seconds were observed during tests.

The support form allows users to provide personal data and to attach files. Also, there is an Additional Information section that asks for WordPress and SSH credentials. All this information can be publicly read when submitting the form, allowing an attacker to hijack an administrator's account or in some cases the webserver.

This issue can be exploited by making an administrator submit a support ticket and requesting the files. It's also possible to probe a server for the files every few seconds until a support ticket is submitted.
Proof of Concept


Have an administrator submit a support ticket. Right after the administrator clicks Submit request, download the following file from the server:

<wordpress server>/wp-content/cache/tmp/php_info.html

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    11 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close