CVE-2017-5489: WordPress CSRF bypass via Flash file upload

CVE-2017-5489 · Severity: high · CVSS 8.8 · Published 2017-01-15

WordPress, a widely used website management platform, was found to have a security flaw that could allow attackers to take over a user's session. By tricking an authenticated user into visiting a malicious link or interacting with a specially crafted Flash file, an attacker could perform actions on the website as if they were that user. This could lead to unauthorized changes to the website or access to sensitive administrative functions.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2017-5489 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2017-5489 being exploited in the wild.
How severe is CVE-2017-5489?
High severity, with a CVSS score of 8.8, published 15 January 2017.
Which products and versions are affected?
WordPress WordPress < 4.7.1.
Is there a fix for CVE-2017-5489?
A patch was published on 2017-01-11: WordPress 4.7.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5489 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2017-5489?
Check whether you run Wordpress. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-site request forgery (CSRF) vulnerability exists in WordPress versions prior to 4.7.1. The flaw is rooted in how the application handles Flash file uploads, which can be leveraged to bypass CSRF protections. An unauthenticated remote attacker can exploit this by inducing a logged-in user (such as an administrator) to interact with a malicious vector involving a Flash file. Successful exploitation allows the attacker to hijack the victim's session and perform unauthorized actions with the victim's privileges. This issue was addressed in the WordPress 4.7.1 security and maintenance release.

Affected products

  • WordPress WordPress < 4.7.1

Timeline

  • 2017-01-11: patched: WordPress 4.7.1 released
  • 2017-01-14: disclosed: CVE assigned and public mailing list discussion
  • 2017-01-15: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.