[Plugin: Relocate Upload] Possible 'abspath' vulnerability on version 0.14

Resolved José Luís
(@jlcarneiro)

14 years, 7 months ago

According to WebsiteDefender, version 0.14 has an abspath vulnerability:
——-
The WordPress plugin relocate-upload from your WordPress installation in / is known to be affected by a security vulnerability.

Vulnerability details
Title: WordPress Relocate Upload Plugin ‘abspath’ Parameter Remote File Include Vulnerability
Version: 0.14
Description: WordPress Relocate Upload plugin is prone to a remote file include vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible. Relocate Upload plugin version 0.14 is vulnerable; prior versions may also be affected.
Solution: Update the WordPress plugin to the latest version or contact the vendor for more information about a fix.
——-

Could you please verify it?

http://wordpress.org/extend/plugins/relocate-upload/

Viewing 9 replies - 1 through 9 (of 9 total)

Thread Starter José Luís
(@jlcarneiro)

14 years, 7 months ago

More info on the matter can be found here: http://1337day.com/exploits/16950

Thread Starter José Luís
(@jlcarneiro)

14 years, 7 months ago

Even more info on this matter: http://www.securityfocus.com/bid/49693/discuss

Looking at the vulnerable code, I thought this could be corrected by changing:
require_once(urldecode($_GET['abspath']).'/wp-load.php')
to:
require_once( ABSPATH . 'wp-load.php')

Am I correct?

Thread Starter José Luís
(@jlcarneiro)

14 years, 7 months ago

Any news here?

Mark (podz)
(@podz)

14 years, 3 months ago

This is being investigated.

As always with security issues it is better – and quicker – to send information to plugins@wordpress.org

Plugin Author alanft
(@alanft)

14 years, 3 months ago

i’ve just committed version 0.20 that uses WP’s own AJAX action method rather than my massively flawed attempt

Thread Starter José Luís
(@jlcarneiro)

14 years, 3 months ago

Where is the plugin homepage? WordPress Extend Plugins report it missing… What happened?

Mark (podz)
(@podz)

14 years, 3 months ago

Sorry for the delay – all my fault.

wordpress.org/extend/plugins/relocate-upload/

is back.

Thread Starter José Luís
(@jlcarneiro)

14 years, 3 months ago

Thanks!

I’ll try it ASAP (my WordPress installation has not detected the update yet, maybe in a few minutes).

Thread Starter José Luís
(@jlcarneiro)

14 years, 3 months ago

Updated. Appears to be working fine.

So far, so good…

Thanks once again!

Viewing 9 replies - 1 through 9 (of 9 total)

The topic ‘[Plugin: Relocate Upload] Possible 'abspath' vulnerability on version 0.14’ is closed to new replies.