A path traversal vulnerability exists in the WordPress Photo Gallery plugin versions 1.3.34-1.3.42. The vulnerability lies in the plugin’s file manager component, allowing attackers directory traversal capabilities resulting in the ability to copy sensitive files into a web-readable directory.
Exploitation
Stages
- An authenticated attacker modifies the URL passed to the plugin’s file manager component to contain path traversal.
- The plugin’s file manager returns the requested path.
Prerequisites
You must have WordPress Photo Gallery version 1.3.34–1.3.42 along with a valid authentication token permitted to use the plugin.
Vulnerability Description
A path traversal vulnerability exists in the WordPress Photo Gallery plugin versions 1.3.34-1.3.42. The vulnerability lies in the plugin’s file manager component. This component allows access to specific parts of the WordPress filesystem. However, it does not sanitize directory paths, allowing attackers directory traversal capabilities, resulting in the ability to copy sensitive files into a web-readable directory.
Alert Logic Coverage
Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.
The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.
Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager™ service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.
Recommendations for Mitigation
Customers are advised to perform the following actions:
- Update the plugin to the latest version
- Disable the plugin and seek an alternative non-vulnerable plugin
Comments
0 comments
Please sign in to leave a comment.