CVE-2014-125104: Unrestricted Upload of File with Dangerous Type (CWE-434)
value: A vulnerability was found in VaultPress Plugin up to 1.6.0 on WordPress. It has been declared as critical. Affected by this vulnerability is the function protect_aioseo_ajax of the file class.vaultpress-hotfixes.php of the component MailPoet Plugin. The manipulation leads to unrestricted upload. The attack can be launched remotely. Upgrading to version 1.6.1 is able to address this issue. The patch is named e3b92b14edca6291c5f998d54c90cbe98a1fb0e3. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230263.
CWE description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CVSS v3 base score: 9.8
Published: 2023-06-01T13:15Z
Repository: https://github.com/wp-plugins/vaultpress
Language: PHP
Files changed: class.vaultpress-hotfixes.php, readme.txt, vaultpress.php
Commit date: 2014-07-01 21:52:10 +0000
Commit message: Adding a new hotfix for the MailPoet (wysija-newsletters) Remote File Upload vulnerability.


git-svn-id: https://plugins.svn.wordpress.org/vaultpress/trunk@941846 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/class.vaultpress-hotfixes.php b/class.vaultpress-hotfixes.php
index 670c2c6..afdfdf2 100644
--- a/class.vaultpress-hotfixes.php
+++ b/class.vaultpress-hotfixes.php
@@ -83,10 +83,13 @@ class VaultPress_Hotfixes {
 		add_filter( 'jetpack_xmlrpc_methods', array( $this, 'disable_jetpack_xmlrpc_methods_293' ), 20, 3 );
 		add_filter( 'xmlrpc_methods', array( $this, 'disable_xmlrpc_methods_293' ), 20 );
 
 		// Protect All-in-one SEO from non-authorized users making changes, and script injection attacks.          
 		add_action( 'wp_ajax_aioseop_ajax_save_meta', array( $this, 'protect_aioseo_ajax' ), 1 );
+
+		// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
+		add_action( 'admin_init', array( $this , 'protect_wysija_newsletters_verify_capability' ), 1 );
 	}
 
 	function disable_jetpack_xmlrpc_methods_293( $jetpack_methods, $core_methods, $user = false ) {
 		if ( $this->needs_jetpack_293_fix() && !$user )
 			unset( $jetpack_methods['jetpack.jsonAPI'], $jetpack_methods['jetpack.verifyAction'] );
@@ -572,10 +575,49 @@ EOD;
 			die();
 
 		// Strip tags from the metadata value.
 		$_POST['new_meta'] = strip_tags( $_POST['new_meta'] );
 	}
+
+	// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
+	function protect_wysija_newsletters_verify_capability() {
+		if ( !class_exists( 'WYSIJA_object' ) )
+			return true;
+		if ( version_compare( WYSIJA::get_version(), '2.6.7', '>=' ) )
+			return true;
+		if ( !defined( 'DOING_AJAX' ) && !defined( 'WYSIJA_ITF' ) )
+			return true;
+        if( isset( $_REQUEST['page'] ) && substr( $_REQUEST['page'] ,0 ,7 ) == 'wysija_' ){
+
+            switch( $_REQUEST['page'] ){
+                case 'wysija_campaigns':
+                    $role_needed = 'wysija_newsletters';
+                    break;
+                case 'wysija_subscribers':
+                    $role_needed = 'wysija_subscribers';
+                    break;
+                case 'wysija_config':
+                    $role_needed = 'wysija_config';
+                    break;
+                case 'wysija_statistics':
+                    $role_needed = 'wysija_stats_dashboard';
+                    break;
+                default:
+                    $role_needed = 'switch_themes';
+            }
+
+            if( current_user_can( $role_needed ) ){
+                return true;
+            } else{
+                die( 'You are not allowed here.' );
+            }
+
+        }else{
+            // this is not a wysija interface/action we can let it pass
+            return true;
+        }
+    }
 }
 
 global $wp_version;
 $needs_class_fix = version_compare( $wp_version, '3.1', '>=') && version_compare( $wp_version, '3.1.3', '<' );
 if ( defined( 'XMLRPC_REQUEST' ) && XMLRPC_REQUEST && $needs_class_fix ) {
diff --git a/readme.txt b/readme.txt
index 24ef34d..559f6c2 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === VaultPress ===
 Contributors: automattic, apokalyptik, briancolinger, josephscott, shaunandrews, xknown, thingalon
 Tags: security, malware, virus, backups, scanning
 Requires at least: 2.9.2
 Tested up to: 3.9.1
-Stable tag: 1.6
+Stable tag: 1.6.1
 License: GPLv2
 
 VaultPress is a subscription service offering realtime backup, automated security scanning, and support from WordPress experts.
 
 == Description ==
@@ -49,10 +49,13 @@ A VaultPress subscription is for a single WordPress site. You can purchase addit
 = Does VaultPress work with WordPress 3.0 Multisite installs? =
 
 Yes, VaultPress supports Multisite installs. Each site will require its own subscription.
 
 == Changelog ==
+= 1.6.1 =
+* Security: Add a new security hotfix.
+
 = 1.6 =
 * Bugfix: Better handling for Multisite table prefixes.
 * Bugfix: Do not use the deprecated wpdb::escape() method.
 
 = 1.5.9 =
diff --git a/vaultpress.php b/vaultpress.php
index d48ca9b..8ec1c9a 100644
--- a/vaultpress.php
+++ b/vaultpress.php
@@ -1,11 +1,11 @@
 <?php
 /*
  * Plugin Name: VaultPress
  * Plugin URI: http://vaultpress.com/?utm_source=plugin-uri&amp;utm_medium=plugin-description&amp;utm_campaign=1.0
  * Description: Protect your content, themes, plugins, and settings with <strong>realtime backup</strong> and <strong>automated security scanning</strong> from <a href="http://vaultpress.com/?utm_source=wp-admin&amp;utm_medium=plugin-description&amp;utm_campaign=1.0" rel="nofollow">VaultPress</a>. Activate, enter your registration key, and never worry again. <a href="http://vaultpress.com/help/?utm_source=wp-admin&amp;utm_medium=plugin-description&amp;utm_campaign=1.0" rel="nofollow">Need some help?</a>
- * Version: 1.6
+ * Version: 1.6.1
  * Author: Automattic
  * Author URI: http://vaultpress.com/?utm_source=author-uri&amp;utm_medium=plugin-description&amp;utm_campaign=1.0
  * License: GPL2+
  * Text Domain: vaultpress
  * Domain Path: /languages/
@@ -16,11 +16,11 @@ if ( !defined( 'ABSPATH' ) )
 	return;
 
 class VaultPress {
 	var $option_name    = 'vaultpress';
 	var $db_version     = 3;
-	var $plugin_version = '1.6';
+	var $plugin_version = '1.6.1';
 
 	function __construct() {
 		register_activation_hook( __FILE__, array( $this, 'activate' ) );
 		register_deactivation_hook( __FILE__, array( $this, 'deactivate' ) );
 

Vulnerable code: Stable tag: 1.6
 * Version: 1.6
	var $plugin_version = '1.6';
Fixed code: 
		// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
		add_action( 'admin_init', array( $this , 'protect_wysija_newsletters_verify_capability' ), 1 );

	// Protect The MailPoet plugin (wysija-newsletters) from remote file upload. Affects versions <= 2.6.6
	function protect_wysija_newsletters_verify_capability() {
		if ( !class_exists( 'WYSIJA_object' ) )
			return true;
		if ( version_compare( WYSIJA::get_version(), '2.6.7', '>=' ) )
			return true;
		if ( !defined( 'DOING_AJAX' ) && !defined( 'WYSIJA_ITF' ) )
			return true;
        if( isset( $_REQUEST['page'] ) && substr( $_REQUEST['page'] ,0 ,7 ) == 'wysija_' ){

            switch( $_REQUEST['page'] ){
                case 'wysija_campaigns':
                    $role_needed = 'wysija_newsletters';
                    break;
                case 'wysija_subscribers':
                    $role_needed = 'wysija_subscribers';
                    break;
                case 'wysija_config':
                    $role_needed = 'wysija_config';
                    break;
                case 'wysija_statistics':
                    $role_needed = 'wysija_stats_dashboard';
                    break;
                default:
                    $role_needed = 'switch_themes';
            }

            if( current_user_can( $role_needed ) ){
                return true;
            } else{
                die( 'You are not allowed here.' );
            }

        }else{
            // this is not a wysija interface/action we can let it pass
            return true;
        }
    }
Stable tag: 1.6.1
= 1.6.1 =
* Security: Add a new security hotfix.

 * Version: 1.6.1
	var $plugin_version = '1.6.1';