Executive brief
A vulnerability in WordPress, a popular website management platform, allows logged-in users with low privileges to disrupt the site's availability. By exploiting a flaw in how the system handles plugin updates, an attacker can force the server to perform resource-intensive tasks that lead to a denial-of-service condition. This can result in the website becoming unresponsive to legitimate visitors, potentially impacting business operations and reputation.
Technical details
A directory traversal vulnerability exists in the 'wp_ajax_update_plugin' function within 'wp-admin/includes/ajax-actions.php'. The root cause is that the 'plugin' parameter is used to retrieve version information before the application performs capability checks or CSRF nonce validation. An authenticated attacker (even with 'Subscriber' privileges) can provide a path like '../../../../dev/random' to deplete the server's entropy pool, causing PHP processes to block and leading to a Denial of Service (DoS). Additionally, the flaw can be used to read the first 8KB of files that contain a 'Version:' string. The issue is mitigated in WordPress 4.6 by moving security checks to the beginning of the affected method.
Affected products
- WordPress WordPress 4.5.3
Timeline
- 2016-07-12: other: Vulnerability discovered during Summer of Pwnage event
- 2016-08-20: disclosed: Public disclosure via oss-security mailing list
- 2016-08-22: other: Exploit code published on Exploit-DB
- 2017-01-18: advisory: NVD publication date