Multiple vulnerabilities in W3 Total Cache plugin for WordPress



Published: 2019-05-07
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID N/A
CWE-ID CWE-20
CWE-918
CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Public exploit code for vulnerability #3 is available.
Vulnerable software
Subscribe 		W3 Total Cache
Web applications / Modules and components for CMS

Vendor Frederick Townes

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU18404

Risk: Low

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to insufficient validation of "openssl_verify" result in "/services/MessageValidator/MessageValidator.php". A remote attacker can create a specially crafted certificate and bypass cryptographic check.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

W3 Total Cache: 0.5 - 0.9.7.3

CPE2.3 External links

http://plugins.trac.wordpress.org/changeset/2081515/w3-total-cache#file21


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU18406

Risk: Medium

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in the opcache_flush_file() function that calls file_exists() function on attacker-controlled data. A remote attacker can send a specially crafted HTTP request to the "/wp-content/plugins/w3-total-cache/pub/opcache.php" URL and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Example: 

curl 'http://[host]/wp-content/plugins/w3-total-cache/pub/opcache.php' --data 'nonce=974ca6ad15021a6668e7ae02e1be551c&command=flush_file&file=[TARGET_URL]'

Mitigation

Install updates from vendor's website.

Vulnerable software versions

W3 Total Cache: 0.5 - 0.9.7.3

CPE2.3 External links

http://plugins.trac.wordpress.org/changeset/2081515/w3-total-cache#file24


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Cross-site scripting

EUVDB-ID: #VU18407

Risk: Medium

CVSSv3.1:

CVE-ID: N/A

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via "command" HTTP POST parameter to "/wp-content/plugins/w3-total-cache/pub/opcache.php" script. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

W3 Total Cache: 0.5 - 0.9.7.3

CPE2.3 External links

http://plugins.trac.wordpress.org/changeset/2081515/w3-total-cache#file24


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###