FKIE_CVE-2019-11185

Vulnerability from fkie_nvd - Published: 2019-06-03 21:29 - Updated: 2024-11-21 04:20
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending "magic bytes" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin's MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension.
References
cve@mitre.orghttps://wordpress.org/plugins/wp-live-chat-support/#developersThird Party Advisory
cve@mitre.orghttps://wp-livechat.com/Vendor Advisory
cve@mitre.orghttps://wpvulndb.com/vulnerabilities/9320Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wordpress.org/plugins/wp-live-chat-support/#developersThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://wp-livechat.com/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://wpvulndb.com/vulnerabilities/9320Exploit, Third Party Advisory
Impacted products
Vendor Product Version
3cx live_chat *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:3cx:live_chat:*:*:*:*:*:wordpress:*:*",
              "matchCriteriaId": "67BCD490-D917-4DCD-9A08-73158864786C",
              "versionEndExcluding": "8.0.26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WP Live Chat Support Pro plugin through 8.0.26 for WordPress contains an arbitrary file upload vulnerability. This results from an incomplete patch for CVE-2018-12426. Arbitrary file upload is achieved by using a non-blacklisted executable file extension in conjunction with a whitelisted file extension, and prepending \"magic bytes\" to the payload to pass MIME checks. Specifically, an unauthenticated remote user submits a crafted file upload POST request to the REST api remote_upload endpoint. The file contains data that will fool the plugin\u0027s MIME check into classifying it as an image (which is a whitelisted file extension) and finally a trailing .phtml file extension."
    },
    {
      "lang": "es",
      "value": "El plugin WP Live Chat Support Pro a trav\u00e9s de 8.0.26 para WordPress contiene una vulnerabilidad de carga de archivos arbitraria. Esto resulta de un ajuste incompleto para CVE-2018-12426. La carga arbitraria de archivos se logra utilizando una extensi\u00f3n de archivo ejecutable no incluida en la lista negra junto con una extensi\u00f3n de archivo en la lista blanca, y a\u00f1adiendo \"bytes m\u00e1gicos\" a la carga \u00fatil para pasar las comprobaciones MIME. Espec\u00edficamente, un usuario remoto no identificado env\u00eda una solicitud POST de carga de archivos dise\u00f1ada al punto final REST api remote_upload. El archivo contiene datos que enga\u00f1ar\u00e1n al cheque MIME del plugin al clasificarlo como una imagen (que es una extensi\u00f3n de archivo en la lista blanca) y, finalmente, una extensi\u00f3n de archivo .phtml final."
    }
  ],
  "id": "CVE-2019-11185",
  "lastModified": "2024-11-21T04:20:41.470",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-06-03T21:29:00.490",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://wordpress.org/plugins/wp-live-chat-support/#developers"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wp-livechat.com/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/9320"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://wordpress.org/plugins/wp-live-chat-support/#developers"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://wp-livechat.com/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://wpvulndb.com/vulnerabilities/9320"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.