Advanced Access Manager <= 3.2.1 Severe Security Vulnerability

In the quest for a good solution to allow different groups to control their own content on a WordPress site, I came across the Advanced Access Manager plugin. During a standard cursory investigation of the code I discovered that any logged in user could execute any of the AJAX actions without proper authorization.

As a normal subscriber account, I was able to give myself administrator privileges on the site and do much more.

The wordpress.org repository claims there are 50,000+ active installs of this plugin.  If you are using a version <= 3.2.1, upgrade immediately.

Nonce Leak

The AJAX actions were protected only with the ‘aam_ajax’ nonce which could be leaked by passing in HTTP POST variable ‘action=aam’. The following function is called from the ‘admin_print_scripts’ action, which in turn calls the printLocalization() function which includes the nonce.

aam-nonce-leak

aam-nonce-leak1

Unrestricted AJAX Actions

Once you have acquired a valid nonce, as a logged in user you can then call the ‘aam’ AJAX action.

aam-ajax

Which will allow you to call any function in the ‘AAM_Backend_View’ class or in any class that begins with ‘AAM_Backend_’

aam-ajax1

Almost every action taken by this plugin goes through this function, so anything that an administrator can do is now accessible to anyone with basic login credentials.

Timeline

  • 5/11/2016 8:25pm Submitted contact form for initial contact
  • 5/12/2016 5:34am Response received
  • 5/12/2016 8:10am Initial Disclosure
  • 6/15/2016 GitHub repository updated
  • 6/20/2016 Version 3.2.2 released

Ultimate Member <= 1.3.52 allows users to set arbitrary user meta data

It had been over a year since I last looked at the Ultimate Member plugin. The free version claims to have 30,000+ installs now on the wordpress.org repository page.

I have a need for a project I’m working on and was hoping it would be a good fit. After a bit of digging I noticed a severe issue that allowed a logged in user to modify arbitrary user_meta data.

Most of the information a user could edit through their user profile page, but there are certain data pairs that should not be able to be modified (like the wp_capabilities field).  If a user is able to change this they can give themselves administrator privileges on a site.

Timeline

Ninja Forms <= 2.9.42 Multiple Critical Security Vulnerabilities

ninjaforms

Multiple critical security vulnerabilities were discovered in the Ninja Forms plugin for WordPress. If you are using a version less than 2.9.42, update immediately!

Ninja Forms is a very popular WordPress plugin to easily build forms for WordPress.  The WordPress.org repository claims there are 500,000+ active installs and ninjaforms.com claims there have been over 2.38 million downloads of the plugin as of May 4th 2016. The plugin is currently listed as the 35th most popular plugin in the WordPress.org repository.

Multiple critical security vulnerabilities were discovered while doing a cursory investigation before deciding to use a plugin and disclosed to the WP Ninjas team. I did not do a full audit of the code base but I recommended the team do a complete audit before releasing an update. After they were patched, I recommended they contact the WordPress.org plugin security team to get help with forcing an automatic security update.

Vulnerable Versions

Version 2.9.36 to 2.9.42 are vulnerable to all of the following critical security vulnerabilities. The most sever vulnerability allows unrestricted uploading of files which could allow remote code execution on a typical webserver setup. The only condition required on a site to attack it is to already have a form enabled, which if this plugin is installed the chances of a form being in use are very high.

Read more