WordPress Plugin Crelly Slider <= 1.3.4 Authenticated Arbitrary File Upload

An authenticated arbitrary file upload vulnerability exists in the WordPress Plugin Crelly Slider < = 1.3.4. It is caused by insufficient checks for user permissions and the lack of file input sanitization, which has been corrected in version 1.3.5. Users with the role of “Subscriber” and above can exploit this vulnerability.

Exploitation

Stages

1. An attacker sends a zipped payload to the server (parameter not specified).
2. The server responds back with an array with null values.
3. The attacker can now access uploaded files in the plugin’s temp directory.

Prerequisites

The attack is authenticated; however, it only requires subscriber privileges. Additionally, the attack must be posted to/wp-admin/admin-ajax.php.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.