Path traversal in Simple File List plugin for WordPress

Published: 2019-05-27

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	N/A
CWE-ID	CWE-22
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software	Simple File List Web applications / Modules and components for CMS
Vendor	Mitchell Bennis - Element Engage, LLC

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU18617

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: N/A

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences passed via the "eeDeleteFile[]" HTTP POST parameter. A remote authenticated attacker can send a specially crafted HTTP request and delete arbitrary files on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Simple File List: 1.0.1 - 3.2.4

CPE2.3

External links

https://docs.google.com/document/d/11KLjuMaHLjPBf2R-Af1R01JNebD5mLRDBnCadmNmC_M/edit
https://plugins.trac.wordpress.org/changeset/2093272/simple-file-list

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Path traversal

EUVDB-ID: #VU18618

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]