Details ================ Software: WP Image Zoom Version: 1.23 Homepage: https://ift.tt/2qkx7m3 Advisory report: https://ift.tt/2GNuO19 CVE: Awaiting assignment CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C) Description ================ WP Image Zoom allows anybody to cause denial of service Vulnerability ================ WP Image Zoom includes an AJAX action which allows any logged in user to set any option to “1”. This means that any logged in user can cause a denial of service for all WP URLs by setting the “template” option to “1”. Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service. Proof of concept ================ Press the submit button in the following HTML snippet:
This will set the template option to 1 causing fatal errors for any WordPress URL. In a real attack the form could be set to autosubmit so no user interaction is required except for following a link. Mitigations ================ Upgrade to version 1.24 or later. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://ift.tt/1B6NWzd Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2018-03-20: Discovered 2018-03-27: Reported to author via https://ift.tt/2qjSjZu 2018-03-27: Vendor responded 2018-03-29: Vendor reported issue fixed in version 1.24 Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information.
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment