RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Reliance on File Name or Extension of Externally-Supplied File [CWE-646] Date found: 2022-02-21 Date published: 2022-07-22 CVSSv3 Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) CVE: CVE-2022-25812 2. CREDITS ========== This vulnerability was discovered and researched by Julien Ahrens from RCE Security. 3. VERSIONS AFFECTED ==================== Transposh WordPress Translation 1.0.8.1 and below 4. INTRODUCTION =============== Transposh translation filter for WordPress offers a unique approach to blog translation. It allows your blog to combine automatic translation with human translation aided by your users with an easy to use in-context interface. (from the vendor's homepage) 5. VULNERABILITY DETAILS ======================== The plugin's "save_transposh" action available at "/wp-admin/admin.php?page=tp_advanced" does not properly validate the "Log file name" allowing an attacker with the "Administrator" role to specify a .php file as the log destination. Since the log file is stored directly within the "/wp-admin" directory, executing arbitrary PHP code is possible by simply sending a crafted request that gets logged. Successful exploits can allow the attacker to compromise the entire WordPress installation. This is specifically relevant in multi-site installations. 6. PROOF OF CONCEPT =================== 1.Go to "/wp-admin/admin.php?page=tp_advanced" and "Enable debugging" by pointing it to a filename with a .php extension. 2.Set the "Level of logging" to "Debug" 3.Saving the settings 4.Submit a payload like "<?php phpinfo();?>" to any of Transposh's functionalities. 5.Go to "/wp-admin/[your-filename.php]" to trigger the code injection 7. SOLUTION =========== None. Remove the plugin to prevent exploitation. 8. REPORT TIMELINE ================== 2022-02-21: Discovery of the vulnerability 2022-02-21: Contacted the vendor via email 2022-02-21: Vendor response 2022-02-22: CVE requested from WPScan (CNA) 2022-02-23: WPScan assigns CVE-2022-25812 2022-05-22: Sent request for status update on the fix 2022-05-24: Vendor states that there is no update planned so far 2022-07-22: Public disclosure 9. REFERENCES ============= https://github.com/MrTuxracer/advisories
Attachment:
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/