\n
The upload of arbitrary file extension was tested on a customers instance of wordpress + super forms.<\/p>\n
To reproduce:
1) Setup wordpress with super forms and create a form containing an upload form
2) Before submitting this form, set a cookie PHPSESSID to the path relative to the upload directory, e.g. PHPSESSID=..\/<\/p>\n
As a consequence, we used the generation of the [userid] for the subfolder to upload the file to a different path. The source code in \/uploads\/php\/UploadHandler.php:<\/p>\n<\/div>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" global_colors_info=\"{}\"]protected function get_user_id() {
\n@session_start();
\nreturn session_id();
\n}<\/code><\/pre>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n
The session_id() can be changed by the PHPSESSID cookie. We set it to value ..\/ which changes the upload path to: uploads\/php.<\/p>\n
File execution:
Usually, the uploaded files were copied to a subfolder with a random [userid] on the server: wpcontent\/plugins\/super-forms\/uploads\/php\/files\/[userid]\/[filename]. In the folder php\/files\/ there is a .htaccess file that denies the execution of php files:<\/p>\n
[\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd-2019-0002-codesnippet1.png\" title_text=\"usd-2019-0002-codesnippet1\" _builder_version=\"4.9.4\" _module_preset=\"default\" custom_margin=\"27px||26px||false|false\" global_colors_info=\"{}\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" custom_margin=\"||27px||false|false\" global_colors_info=\"{}\"]<\/p>\n
\n
\n
\n
Since the directory uploads\/php is not restricted in php code execution by the mentioned .htaccess file, a php reverse shell is possible.<\/p>\n<\/div>\n<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" global_colors_info=\"{}\"]<\/p>\n
\n
\n
Fix<\/h3>\n
Disclaimer<\/i>
The suggested fix is just a temporary workaround and not a final fix that ensures the full security of this wordpress plugin. It is intended to support the developers to close this vulnerability.<\/p>\n
The vulnerabilities we found are not yet fixed by the latest version of this plugin. One option is to turn it off.<\/p>\n
Another option is to apply the following temporary fixes:
In \/uploads\/php\/UploadHandler.php replace the function get_user_id() to return a value an attacker cannot tamper with.<\/p>\n
<\/h3>\nTimeline<\/h3>\n\n- 2019-01-25 First Contact request via contact form to: https:\/\/codecanyon.net\/item\/super-forms-drag-drop-form-builder\/13979866\/support<\/li>\n
- 2019-02-05 Vendor releases version 4.5.3 with a supposed fix. We could still exploit the vulnerability. (related: Changelog on https:\/\/codecanyon.net\/item\/super-forms-drag-drop-form-builder\/13979866)<\/li>\n
- 2019-07-31 Security advisory released<\/li>\n<\/ul>\n
<\/h3>\nCredits<\/h3>\n
This security vulnerabilities were found by Tim Kranz and Matthias G\u00f6hring of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"
usd-2019-0002 | feeling4design Super Forms \u2013 Drag & Drop Form Builder\/1.0.0 \u2013 4.4.8 Advisory ID: usd-2019-0002CVE Number: N\/AAffected Product: Super FormsAffected Version: 1.0.0 \u2013 4.4.8Vulnerability Type: Path TraversalSecurity Risk: CriticalVendor URL:https:\/\/github.com\/RensTillmann\/super-formshttp:\/\/codecanyon.net\/user\/feeling4designVendor Status: Not fixed Description The attacker can upload files to arbitrary locations by manipulating the [userid] stored in the session cookie. This vulnerability when […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16599","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16599"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16599\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}