[FD] WP Image Zoom allows anybody to cause denial of service (WordPress plugin)

Details ================ Software: WP Image Zoom Version: 1.23 Homepage: https://ift.tt/2qkx7m3 Advisory report: https://ift.tt/2GNuO19 CVE: Awaiting assignment CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C) Description ================ WP Image Zoom allows anybody to cause denial of service Vulnerability ================ WP Image Zoom includes an AJAX action which allows any logged in user to set any option to “1”. This means that any logged in user can cause a denial of service for all WP URLs by setting the “template” option to “1”. Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service. Proof of concept ================ Press the submit button in the following HTML snippet:

This will set the template option to 1 causing fatal errors for any WordPress URL. In a real attack the form could be set to autosubmit so no user interaction is required except for following a link. Mitigations ================ Upgrade to version 1.24 or later. Disclosure policy ================ dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://ift.tt/1B6NWzd Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf. This vulnerability will be published if we do not receive a response to this report with 14 days. Timeline ================ 2018-03-20: Discovered 2018-03-27: Reported to author via https://ift.tt/2qjSjZu 2018-03-27: Vendor responded 2018-03-29: Vendor reported issue fixed in version 1.24 Discovered by dxw: ================ Tom Adams Please visit security.dxw.com for more information.

Source: Gmail -> IFTTT-> Blogger

from Blogger http://insidenothing.blogspot.com/2018/04/fd-wp-image-zoom-allows-anybody-to.html
via IFTTT

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s