CVE-2005-10002 (published 2023-10-29T15:15Z)

A vulnerability, which was classified as critical, was found in almosteffortless secure-files Plugin up to 1.1 on WordPress. Affected is the function sf_downloads of the file secure-files.php. The manipulation of the argument downloadfile leads to path traversal. Upgrading to version 1.2 is able to address this issue. The name of the patch is cab025e5fc2bcdad8032d833ebc38e6bd2a13c92. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-243804.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/wp-plugins/secure-files
commit_details: repo_url: https://github.com/wp-plugins/secure-files
author: trevorturk
author_date: 2005-10-03 05:40:29+00:00
msg: Fixed potential security exploit.

git-svn-id: https://plugins.svn.wordpress.org/secure-files/trunk@3641 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/secure-files
repo_name: wp-plugins/secure-files
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: secure-files.php
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Plugin Name: Secure Files
 Plugin URI: http://www.almosteffortless.com/wordpress/
 Description: This plugin allows you to upload and download files from outside of your web document root for security purposes. When used in conjunction with a plugin that requires a user to be logged in to see your site, you can restrict file downloads to users that are logged in. It can be found in Manage -> Secure Files.
 Author: Trevor Turk
-Version: 1.1
+Version: 1.2
 Author URI: http://www.almosteffortless.com/
 */ 
 
@@ -67,7 +67,7 @@ Author URI: http://www.almosteffortless.com/
 		if (isset($_GET["$sf_prefix"])) {
 			$downloadfile = $_GET["$sf_prefix"];
 			$sf_directory = get_option('sf_directory');
-			$downloadfile = $sf_directory . $downloadfile;
+			$downloadfile = $sf_directory . basename($downloadfile);
 			if (is_file($downloadfile)) {
 				header('Content-Description: File Transfer'); 
 				header('Content-Type: application/force-download'); 

programming_language: PHP