DOS vulnerability

  • Resolved David Anderson

    (@davidanderson)


    8 years, 3 months ago

    Hi,

    Reading the code of your plugin, I think you have a DOS vulnerability. An unauthenticated, not-logged-in user can make calls to tux_handle_upload.php directly. That file performs no authentication, and will write as much attacker-controlled data to disk as requested to, until the disk is completely filled.

    The plupload URL shouldn’t point directly to a script that performs no authentication like that – it should point to admin-ajax.php, and use WP’s authentication system to ensure that the uploader is a logged-in, authorised user. See in UpdraftPlus (updraftplus/admin.php) for an example.

    David

    https://wordpress.org/plugins/tuxedo-big-file-uploads/

Viewing 2 replies - 1 through 2 (of 2 total)
  • Plugin Contributor Trevor Anderson

    (@andtrev)

    8 years, 3 months ago

    Yes, you’re correct, thanks for pointing this out. It’s fixed in 1.1. I don’t think I can use async-upload.php with a WP AJAX function, which I’d like to have WordPress handle this as normally as possible, and just insert my code in-between.

    Plugin Contributor Trevor Anderson

    (@andtrev)

    8 years, 3 months ago

    Fixed – 1.1 – We now authenticate a logged in user that has the capability to upload files before any processing.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘DOS vulnerability’ is closed to new replies.