Executive brief
A security flaw in WordPress allows attackers to trick logged-in users into performing unintended actions. By exploiting this, an attacker could force a user's browser to read sensitive system files or exhaust server resources, potentially leading to a website crash or service outage. This issue affects sites running WordPress versions earlier than 4.6.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the `wp_ajax_update_plugin` function within `wp-admin/includes/ajax-actions.php`. The root cause is a late call to the `check_ajax_referer` function, which occurs after the application has already processed a path traversal-vulnerable input. An attacker can leverage this to force a logged-in user (even with low privileges like a Subscriber) to trigger a read operation on arbitrary files such as `/dev/random`. Repeatedly reading from `/dev/random` can deplete the system's entropy pool, causing the server to block and resulting in a Denial of Service (DoS). The vulnerability is fixed in WordPress version 4.6 by moving the security and nonce checks to the beginning of the affected method.
Affected products
- WordPress WordPress before 4.6
Timeline
- 2016-06-15: patched: Fixed in WordPress core commit 8c82515ab62b88fb32d01c9778f0204b296f3568
- 2016-08-20: disclosed: Public disclosure via Summer of Pwnage project
- 2017-01-18: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2016/08/20/1
- http://www.securityfocus.com/bid/92572
- http://www.securitytracker.com/id/1036683
- https://github.com/WordPress/WordPress/commit/8c82515ab62b88fb32d01c9778f0204b296f3568
- https://sumofpwn.nl/advisory/2016/path_traversal_vulnerability_in_wordpress_core_ajax_handlers.html
- https://wpvulndb.com/vulnerabilities/8606
- https://www.exploit-db.com/exploits/40288/