Image Slider Plugin on WordPress File denial of service

Summaryinfo

A vulnerability was found in Image Slider Plugin on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. Such manipulation leads to denial of service (File). The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in Image Slider Plugin on WordPress (WordPress Plugin) (version now known). It has been rated as problematic. Affected by this issue is some unknown processing. The manipulation with an unknown input leads to a denial of service vulnerability (File). Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is integrity, and availability.

The bug was discovered 10/29/2015. The weakness was presented 12/23/2016 by Tom Adams as Arbitrary file deletion vulnerability in Image Slider allows authenticated users to delete files (WordPress plugin) as not defined mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release happened without coordination with the vendor. The exploitation is known to be easy. The attack may be launched remotely. Required for exploitation is a simple authentication. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1499. The advisory points out:

Any user able to create or edit “Sliders” (the same users who can create/edit posts, as far as I can tell) is able to delete arbitrary files that the web user has permission to write to. In addition, the attacker is told whether that operation succeeded or failed.

A public exploit has been developed by Tom Adams in HTML and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 421 days. During that time the estimated underground price was around $0-$5k. The code used by the exploit is:

<form action=\"http://localhost/wp-admin/admin-ajax.php\"; method=\"POST\">
  <input type=\"text\" name=\"action\" value=\"ewic_timthumb_check\">
  <input type=\"text\" name=\"turl\" value=\"/etc/hosts\">
  <input type=\"text\" name=\"security\" value=\"NONCE\">
  <input type=\"submit\">
</form>

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Name

• Image Slider Plugin

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion