Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:30291
HistoryFeb 03, 2014 - 12:00 a.m.

Code Execution vulnerability in Contact Form 7 for WordPress

2014-02-0300:00:00
vulners.com
142
JSON

Hello 3APA3A!

I want to inform you about vulnerability in Contact Form 7 plugin for WordPress.

This is Code Execution via Arbitrary File Uploading vulnerability.

Affected products:

Vulnerable are Contact Form 7 3.5.2 and previous versions. After my informing developer released version 3.5.3 with a fix.

Affected vendors:

Contact Form 7
http://contactform7.com

Details:

Code Execution (WASC-31):

Attack is going via uploader. For code execution it's needed to upload phtml (on web servers with PHP) or asp/aspx (on IIS) files.

The attack can be made as by user with admin rights (to make appropriate contact form with uploader tag) and by unauthenticated user, if there is already appropriate contact form at web site (made by unsuspicious admin).

For the first scenario the attack process will be the next.

Attacker with admin access add uploader tag into contact form at the site and use it for CE via AFU attack.

There must be uploader tag in contact form and it's needed to set allowed extension to it (because besides the list of forbidden extensions, the plugin also has the list of allowed extensions and there are no scripts among them).

[file file-423 filetypes:phtml]

The files are uploaded into folder: http://site/wp-content/uploads/wpcf7_uploads/

At creation of this folder the file .htaccess is created (with content: Deny from all).

It can be bypassed at using of other web servers besides Apache (where .htaccess is ignored), or at Apache it's possible to use vulnerabilities in WP for file deletion, or via LFI vulnerability to include a file from this folder.

Timeline:

2013.09.28 - announced at my site.
2013.10.01 - informed developer.
2013.10.03-21 - conversation with developer about this and other vulnerabilities in CF7.
2013.10.09 - plugin version 3.5.3 was released.
2013.11.21 - disclosed at my site (http://websecurity.com.ua/6799/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

JSON