Vendor Description
“PluginUs.Net is a little team of talented professionals from Ukraine. Unlike most of the big companies on the net, we believe in individual approach to every our customer. Web development is our passion and we always try to go an extra mile over our clients’ expectations.
Our team specializes in development of WordPress plugins. It’s always exciting to try new technologies and approaches to get the project done and impress clients by realization of their ideas!”
Source: https://pluginus.net/about-us/
Business Recommendation
SEC Consult recommends to ugprade to the latest version available as soon as possible. Further detailed security tests should be performed in order to identify potential other security issues.
Vulnerability Overview/ Description
1. Arbitrary Shortcode Execution
The plugin implemented a page redraw AJAX function accessible to anyone without any authentication.
WordPress shortcode markup in the “shortcode” parameters would be evaluated. Normally unauthenticated users can’t evaluate shortcodes as they are often sensitive.
Additionally, it is noted that there are other implemented shortcodes that are being used in this plugin which can be abused through the same attack. Worst, some of them could lead to remote code execution.
2. Local File Inclusion
The vulnerability is due to the lack of args/input validation on render_html before allowing it to be called by extract(), a PHP built-in function. Because of this, the supplied args/input can be used to overwrite the $pagepath variable which then could lead to local file inclusion attack.
Proof Of Concept
1. Arbitrary Shortcode Execution
The parameter “shortcode” within the “admin-ajax.php” script is affected by the code execution vulnerability:
POST /wp-admin/admin-ajax.php HTTP/1.1
[...]
action=woof_redraw_woof&shortcode=<<shortcode without []>>
2. Local File Inclusion
The parameter “shortcode” within the “admin-ajax.php” script is affected by the local file inclusion vulnerability:
POST /wp-admin/admin-ajax.php HTTP/1.1
[...]
action=woof_redraw_woof&shortcode=woof_search_options pagepath=/etc/passwd
Vulnerable / Tested Versions
PluginUs.Net WooCommerce Products Filter version 1.1.9 has been tested and found to be vulnerable.