WordPress WooCommerce Checkout Manager plugin <=4.2.6 Arbitrary File Upload

There exists an arbitrary file upload vulnerability in the WordPress plugin WooCommerce Checkout Manager <= 4.2.6. An unauthenticated user can make a crafted request to the vulnerable instance which will be interpreted by the function wccs_upload_file_func_callback. The malicious user only needs to know an order number, and their file will be uploaded to the directory associated with the order. The instance must have the setting “Categorize Upload Files” enabled. 

Exploitation 

Stages 

1. An attacker sends an upload request to a vulnerable WordPress instance containing arbitrary file.  
   
   
2. The server responds with a ‘200’ response code and the line “Files were uploaded successfully.” in the response body. 
   
   
3. The attacker requests the uploaded file from the directory (it will be executed if PHP). 

Prerequisites 

This attack is unauthenticated; however, the malicious user needs to know an order number. The instance must have the setting “Categorize Upload Files” enabled. 

Alert Logic Coverage 

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.  

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.  

Recommendations for Mitigation 

Update to the latest non-vulnerable version of the plugin.