WordPress (CMS) Open-Flash-Chart-Core ofc_upload_image.php RCE

An arbitrary file upload vulnerability exists in the WordPress plugin open-flash-chart-core. An unauthenticated attacker can upload a file and execute arbitrary code on the target system.

Exploitation

Stages

1. The remote unauthenticated attacker sends a request to ‘/php-ofc-library/ofc_upload_image.php?name=’. The uploaded malicious file will be in the name parameter.
2. The server responds successfully with the location of the uploaded file.
3. The attacker sends a request to ‘tmp-upload-images/<malicious file>.php’ to retrieve the uploaded file.

Prerequisites

The target server must have the vulnerable version of the plugin running.

Vulnerability Description

An arbitrary file upload vulnerability exists in the WordPress plugin open-flash-chart-core. The vulnerability resides within the file ‘ofc_upload_image.php’. No authentication checks are carried out on the user requesting the file. Also, no validation checks are made on the file being uploaded. An unauthenticated attacker can upload a file and execute arbitrary code on the target system.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via Alert Logic ActiveWatch for Web Security Manager service. Depending on your deployment of Web Security Manager, you will receive an incident (for out-of-band deployment) or the threat will be actively blocked and rejected (for the inline Web Security Manager Premier deployment) if an exploit attempt is observed.

Recommendations for Mitigation

Upgrade to the latest version of the plugin to mitigate this vulnerability.