Vulnerabilities > CVE-2018-19207 - Forced Browsing vulnerability in Van-Ons Wp-Gdpr-Compliance

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
van-ons
CWE-425
nessus
metasploit
NVD
Published: 2018-11-12
Updated: 2019-10-03

Summary

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

Vulnerable Configurations

Part Description Count
Application
Van-Ons
22

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Directory Indexing
    An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
  • Forceful Browsing
    An attacker employs forceful browsing to access portions of a website that are otherwise unreachable through direct URL entry. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.

Metasploit

descriptionThe Wordpress GDPR Compliance plugin <= v1.4.2 allows unauthenticated users to set wordpress administration options by overwriting values within the database. The vulnerability is present in WordPress’s admin-ajax.php, which allows unauthorized users to trigger handlers and make configuration changes because of a failure to do capability checks when executing the 'save_setting' internal action. WARNING: The module sets Wordpress configuration options without reading their current values and restoring them later.
idMSF:AUXILIARY/ADMIN/HTTP/WP_GDPR_COMPLIANCE_PRIVESC
last seen2020-06-14
modified2018-11-29
published2018-11-29
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/admin/http/wp_gdpr_compliance_privesc.rb
titleWordPress WP GDPR Compliance Plugin Privilege Escalation

Nessus

NASL familyCGI abuses
NASL idWORDPRESS_PLUGIN_WP-GDPR-COMPLIANCE_1_4_3.NASL
descriptionThe WordPress application running on the remote host has a version of the
last seen2020-06-01
modified2020-06-02
plugin id118935
published2018-11-14
reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/118935
titleWordPress Plugin 'WP GDPR Compliance' < 1.4.3 Privilege Escalation
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(118935);
  script_version("1.2");
  script_cvs_date("Date: 2019/11/01");

  script_cve_id("CVE-2018-19207");

  script_name(english:"WordPress Plugin 'WP GDPR Compliance' < 1.4.3 Privilege Escalation");
  script_summary(english:"Checks version of WP GDPR Compliance plugin.");

  script_set_attribute(attribute:"synopsis", value:
"The remote WordPress application has a plugin installed that is vulnerable
to privilege escalation.");
  script_set_attribute(attribute:"description", value:
"The WordPress application running on the remote host has a version of
the 'WP GDPR Compliance' plugin that is prior to 1.4.3 and, thus, is
affected by a user-input validation error that can allow privilege
escalation attacks. Such attacks allow, among other actions, creation
of new administrator-level users.");
  script_set_attribute(attribute:"see_also", value:"https://www.wpgdprc.com/wp-gdpr-compliance-1-4-3-security-release/");
  # https://www.wordfence.com/blog/2018/11/trends-following-vulnerability-in-wp-gdpr-compliance-plugin/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e467f1d9");
  # https://www.wordfence.com/blog/2018/11/privilege-escalation-flaw-in-wp-gdpr-compliance-plugin-exploited-in-the-wild/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8fc561db");
  # https://www.tenable.com/blog/new-wordpress-privilege-escalation-flaw-in-wp-gdpr-compliance-plugin
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5bc767ef");
  script_set_attribute(attribute:"solution", value:
"Update the 'WP GDPR Compliance' plugin to version 1.4.3 or greater
through the administrative dashboard.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-19207");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/11/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/11/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wordpress:wordpress");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wordpress_plugin_detect.nbin");
  script_require_keys("installed_sw/WordPress", "www/PHP");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("vcf.inc");
include("vcf_extras.inc");

app_info = vcf::wordpress::plugin::get_app_info(plugin:"wp-gdpr-compliance");
vcf::check_granularity(app_info:app_info, sig_segments:2);

constraints = [
  { "fixed_version" : "1.4.3" }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);

References