Transposh WordPress Translation 1.0.8.1 Remote Code Execution ≈ Packet Storm

Transposh WordPress Translation 1.0.8.1 Remote Code Execution ≈ Packet Storm

Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]

Transposh WordPress Translation 1.0.8.1 Remote Code Execution[6]
Authored by Julien Ahrens[7] | Site rcesecurity.com[8]

Transposh WordPress Translation versions 1.0.8.1 and below have a "save_transposh" action available at "/wp-admin/admin.php?page=tp_advanced" that does not properly validate the "Log file name" allowing an attacker with the "Administrator" role to specify a .php file as the log destination. Since the log file is stored directly within the "/wp-admin" directory, executing arbitrary PHP code is possible by simply sending a crafted request that gets logged.

advisories | CVE-2022-25812[9]
SHA-256 | 8347827a18239dee9d623ea317bc7751b1e867031f7d4bbe6349594f42f4006f

Change Mirror[13] Download[14]

        RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Transposh WordPress Translation
Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type: Reliance on File Name or Extension of Externally-Supplied File [CWE-646]
Date found: 2022-02-21
Date published: 2022-07-22
CVSSv3 Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
CVE: CVE-2022-25812
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.8.1 and below
4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.
(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The plugin's "save_transposh" action available at "/wp-admin/admin.php?page=tp_advanced"
does not properly validate the "Log file name" allowing an attacker with the
"Administrator" role to specify a .php file as the log destination.
Since the log file is stored directly within the "/wp-admin" directory, executing
arbitrary PHP code is possible by simply sending a crafted request that gets
logged.
Successful exploits can allow the attacker to compromise the entire WordPress
installation. This is specifically relevant in multi-site installations.
6. PROOF OF CONCEPT
===================
1.Go to "/wp-admin/admin.php?page=tp_advanced" and "Enable debugging" by pointing
it to a filename with a .php extension.
2.Set the "Level of logging" to "Debug"
3.Saving the settings
4.Submit a payload like "<?php phpinfo();?>" to any of Transposh's functionalities.
5.Go to "/wp-admin/[your-filename.php]" to trigger the code injection
7. SOLUTION
===========
None. Remove the plugin to prevent exploitation.
8. REPORT TIMELINE
==================
2022-02-21: Discovery of the vulnerability
2022-02-21: Contacted the vendor via email
2022-02-21: Vendor response
2022-02-22: CVE requested from WPScan (CNA)
2022-02-23: WPScan assigns CVE-2022-25812
2022-05-22: Sent request for status update on the fix
2022-05-24: Vendor states that there is no update planned so far
2022-07-22: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories

Login[15] or Register[16] to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa

File Tags

File Archives

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec[119]
close
Image

Pensée du jour :

Ce que l'homme a fait ,

l'homme peut le défaire.

 

"No secure path in the world"