wordpress: CVE-2019-8943

Debian Bug report logs - #923583
wordpress: CVE-2019-8943

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: wordpress: CVE-2019-8943

Date: Sat, 02 Mar 2019 14:14:28 +0100

Source: wordpress
Version: 5.0.3+dfsg1-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for wordpress, filling for
tracking. This is the left open issue in 5.0.3 from [1].

CVE-2019-8943[0]:
| WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An
| attacker (who has privileges to crop an image) can write the output
| image to an arbitrary directory via a filename containing two image
| extensions and ../ sequences, such as a filename ending with the
| .jpg?/../../file.jpg substring.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-8943
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8943
[1] https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 923583@bugs.debian.org (full text, mbox, reply):

From: Craig Small <csmall@debian.org>

To: 923583@bugs.debian.org

Subject: Re: Wordpress path traversal

Date: Tue, 16 Apr 2019 21:44:22 +1000

[Message part 1 (text/plain, inline)]

The RCE part was fixed in WordPress 5.0.1 but the path traversal is still a
problem.

So the problem is that for the WordPress core, the way to exploit the path
traversal was taken away (but not the path traversal itself). The author
still states that some plugins or themes may still use this method
incorrectly, leading to a path traversal.

The Ripstech blog post simplifies it, but I can see[1] that the
get_attached_file() in wp-includes/post.php still has the same code. It
just adds the upload directory on instead of sanitizing it.

1:
https://core.trac.wordpress.org/browser/trunk/src/wp-includes/post.php#L452

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.