WordPress FoxyPress Plugin Uploadify.php Arbitrary Code

The FoxyPress plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation.

Exploitation

Stages

1. The malicious user sends an HTTP POST request containing a backdoor payload to the vulnerable server.
2. The vulnerable server responds with a successful response.
3. The malicious user accesses the backdoor installed on the vulnerable host.

Prerequisites

• The vulnerable versions of FoxyPress need to be installed. The vulnerable versions include 0.4.1.1 < 0.4.2.1.
• FoxyPress, along with many other WordPress plugins, utilizes Uploadify. It is a jQuery plugin that allows you to easily add multiple file upload functionalities to your website. However, there is a vulnerability in the code that allows the unrestricted uploading of files. An attacker might be able to upload arbitrary files containing malicious PHP code because the uploaded file extension is not properly checked.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

To mitigate the vulnerability, upgrade to a non-vulnerable version of the plugin.