Follow

09/25/17: WordPress Photo Gallery 1.3.34/1.3.42 Path Traversal | Security Bulletin

Threat Summary

Overview

A path traversal vulnerability exists in the WordPress Photo Gallery plugin versions 1.3.34-1.3.42. The vulnerability lies in the plugin’s file manager component, allowing attackers directory traversal capabilities resulting in the ability to copy sensitive files into a web-readable directory. 

Exploitation

 

Stages

  1. An authenticated attacker modifies the URL passed to the plugin’s file manager component to contain path traversal.
  2. The plugin’s file manager returns the requested path.

Prerequisites

You must have WordPress Photo Gallery version 1.3.34–1.3.42 along with a valid authentication token permitted to use the plugin.

Vulnerability Description

A path traversal vulnerability exists in the WordPress Photo Gallery plugin versions 1.3.34-1.3.42. The vulnerability lies in the plugin’s file manager component. This component allows access to specific parts of the WordPress filesystem. However, it does not sanitize directory paths, allowing attackers directory traversal capabilities, resulting in the ability to copy sensitive files into a web-readable directory.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager™ service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.

Recommendations for Mitigation

Customers are advised to perform the following actions:

  • Update the plugin to the latest version
  • Disable the plugin and seek an alternative non-vulnerable plugin
Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.