[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] =?windows-1252?q?=5BCVE-2022-25812=5D_Transposh_=3C=3D_1=2E0?= =?windows-1252?q?=2E8=2E1_=93sav
From:       "Julien Ahrens (RCE Security)" <info () rcesecurity ! com>
Date:       2022-07-22 14:50:26
Message-ID: 006D23C4-C336-42CF-8A5E-3F0B4F50BD19 () rcesecurity ! com
[Download RAW message or body]

RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product:        Transposh WordPress Translation
Vendor URL:     https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type:           Reliance on File Name or Extension of Externally-Supplied File [CWE-646]
Date found:     2022-02-21
Date published: 2022-07-22
CVSSv3 Score:   9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
CVE:            CVE-2022-25812


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.8.1 and below


4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The plugin's "save_transposh" action available at "/wp-admin/admin.php?page=tp_advanced"
does not properly validate the "Log file name" allowing an attacker with the
"Administrator" role to specify a .php file as the log destination.

Since the log file is stored directly within the "/wp-admin" directory, executing
arbitrary PHP code is possible by simply sending a crafted request that gets
logged.

Successful exploits can allow the attacker to compromise the entire WordPress
installation. This is specifically relevant in multi-site installations.


6. PROOF OF CONCEPT
===================
1.Go to "/wp-admin/admin.php?page=tp_advanced" and "Enable debugging" by pointing
  it to a filename with a .php extension.
2.Set the "Level of logging" to "Debug"
3.Saving the settings
4.Submit a payload like "<?php phpinfo();?>" to any of Transposh's functionalities.
5.Go to "/wp-admin/[your-filename.php]" to trigger the code injection


7. SOLUTION
===========
None. Remove the plugin to prevent exploitation.


8. REPORT TIMELINE
==================
2022-02-21: Discovery of the vulnerability
2022-02-21: Contacted the vendor via email
2022-02-21: Vendor response
2022-02-22: CVE requested from WPScan (CNA)
2022-02-23: WPScan assigns CVE-2022-25812
2022-05-22: Sent request for status update on the fix
2022-05-24: Vendor states that there is no update planned so far
2022-07-22: Public disclosure


9. REFERENCES
=============
https://github.com/MrTuxracer/advisories

["signature.asc" (signature.asc)]

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEWVym3nC1+ioyX1+TzjvwrNEH1JsFAmLauTIACgkQzjvwrNEH
1JsniA/7Bk0yNhkw1OOrEEfnPu4dz8t3DXzf2fypqjNjEhRSMbwJ2OojPNO8qCV8
TLWG0uGLhj3sY9Ztn06N8na7IZUBJ3AC02RhKmBjZqUdIxvcqi2ckdvlOFpqBUE6
sIovc+Cw6nr991GrxrxgPtjSg/rgiNWdD3q48OrA0JJhbG5ZDRVI7hSXDeIETCBJ
s0ERjLm2yibhGQ/XO4HrI19CDlBBONMgV/fWSVTzXPg9gPa1eDhTEkKb6IKrJZpm
mhTmSu4PmD29ku5nIjtBYCpqNUmHFZW9wn3rFg2j3F3VHNBh1L15Ytf3Bc3Ae2y0
ibjHPCUgoS8BlE1MTK/azfFVfbmFguHcRGp6MZjn9uwvaIRSDGw9q3HL2PdQ2yhG
CQxokmNStseKn6EAF1HV7CTMRNaDcVsevhJc/E0NXy9dX4aSCwXIRVOQIHLvHqmN
zXCiJ/+TojKuXCTHdhZomydsRrTAcfWGreFha4MypkyZHgswHGa6FfsUnnEjYi+p
brWchqrW1P4Xkl5lHm/v1aRRStYYMv3F6zpo15c6aLWObRs1zdSQ1TkfO48Rw3Nx
4F+HLzVSmPRUWanHp/mmuHwytghwrDKpz+mHd39P947aGVfQ+AfFoewMM2OfSkCU
rBV2Kz+sXO52bx07R0WBNF5xhFjYVQrzY1kBrBgj1AWMfYgzJYg=
=Pfts
-----END PGP SIGNATURE-----


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
--===============1580819176369385150==--

[prev in list] [next in list] [prev in thread] [next in thread]