wpsoul Greenshift Plugin up to 9.0.0 on WordPress greenshift_download_file_localy authorization

Summaryinfo

A vulnerability was found in wpsoul Greenshift Plugin up to 9.0.0 on WordPress. It has been rated as problematic. Affected is the function greenshift_download_file_localy. The manipulation leads to authorization. This vulnerability is uniquely identified as CVE-2024-6155. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in wpsoul Greenshift Plugin up to 9.0.0 on WordPress. This issue affects the function greenshift_download_file_localy. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, and integrity. The summary by CVE is:

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross Site Scripting in all versions up to, and including, 9.0.0 due to a missing capability check in the greenshift_download_file_localy function, along with no SSRF protection and sanitization on uploaded SVG files. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application that can also be leveraged to download malicious SVG files containing Cross-Site Scripting payloads to the server. On Cloud-based servers, attackers could retrieve the instance metadata. The issue was partially patched in version 8.9.9 and fully patched in version 9.0.1.

The weakness was disclosed by Arkadiusz Hydzik. It is possible to read the advisory at wordfence.com. The identification of this vulnerability is CVE-2024-6155 since 06/18/2024. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 9.0.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• wpsoul

Name

• Greenshift Plugin

Version

• 9.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion