1 Flash Gallery: Arbitrary File Upload
This is a short post documenting the vulnerability I inadvertently found yesterday in the 1 Flash Gallery plugin, which has since been patched. This plugin has been downloaded an estimated 460,000 times, and as of yesterday was ranked by Wordpress as the 17th most popular plugin (although I'm not entirely sure how this judgement is made). A patch has been released, so anyone who has this plugin installed should update immediately. I'll probably do a follow-up in the near future on Wordpress plugins in general, but for now, just the facts.
The 1 Flash Gallery Wordpress plugin is vulnerable to an arbitrary file upload vulnerability. This vulnerability is present from version 1.30 until version 1.5.7.
It is possible to plant a remote shell and thereby execute arbitrary code on the remote host by simply submitting a PHP file via POST request to the following URI on a vulnerable installation:
This works because the upload.php script a.) performs no authentication checks, b.) trusts a user-supplied request variable to provide allowed filetypes, and c.) does not actually validate that the file is a well-formed image file. I have only tested the vulnerability on an installation that does not perform watermarking, the default setting; it may or may not work on installations that do otherwise.
I have created a proof-of-concept Metasploit module demonstrating the vulnerability, which interested persons can download here: https://spareclockcycles.org/downloads/code/fgallery_file_upload.rb
Hosts can be found with the following Google search: inurl:"wp-content/plugins/1-flash-gallery"
I reported the vulnerability to both Wordpress and the plugin developers yesterday, Sep 5 2011. Both responded quickly to the issue, and took appropriate measures. Wordpress temporarily took down the plugin until the patch was released, which the developers did later in the day. I 'd like to thank Wordpress for their fast and professional response.
I am now releasing details of the vulnerability publicly to ensure that users are aware of the issue, and encourage them to update their plugins accordingly. The 1 Flash Gallery developers did not stress the severe implications of this vulnerability in their changelog (or mention that it was a security issue at all), so this post is partly to ensure that the implications are made clear. Personally, I would uninstall the plugin, given its history of serious security issues and the developers' lack of candor about those reported to them.
As always, any comments are welcome.