CVE-2015-10105 (published 2023-05-01T02:15Z)

A vulnerability, which was classified as critical, was found in IP Blacklist Cloud Plugin up to 3.42 on WordPress. This affects the function valid_js_identifier of the file ip_blacklist_cloud.php of the component CSV File Import. The manipulation of the argument filename leads to path traversal. It is possible to initiate the attack remotely. Upgrading to version 3.43 is able to address this issue. The identifier of the patch is 6e6fe8c6fda7cbc252eef083105e08d759c07312. It is recommended to upgrade the affected component. The identifier VDB-227757 was assigned to this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/wp-plugins/ip-blacklist-cloud
commit_details: repo_url: https://github.com/wp-plugins/ip-blacklist-cloud
author: ad33lx
author_date: 2015-03-07 12:10:54+00:00
msg: fixed CSV file import vulnerability - version 3.43

git-svn-id: https://plugins.svn.wordpress.org/ip-blacklist-cloud/trunk@1107588 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/ip-blacklist-cloud
repo_name: wp-plugins/ip-blacklist-cloud
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: ip_blacklist_cloud.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 Plugin Name: IP Blacklist Cloud
 Plugin URI: http://wordpress.org/extend/plugins/ip-blacklist-cloud/
 Description: Blacklist IP Addresses from visiting your WordPress website and block usernames from spamming. View details of all failed login attempts.
-Version: 3.42
+Version: 3.43
 Author: Adeel Ahmed
 Author URI: http://www.ip-finder.me/
 */
@@ -1881,26 +1881,47 @@ $link="http://www.ip-finder.me/wp-content/themes/ipfinder/blacklist_delete.php?I
 		//-----Import Database-----
 		if($_REQUEST['action']=="importCSVIPCloud")
 		{
-			if(current_user_can( 'manage_options' ) && $_REQUEST['filename'])
+			if(current_user_can( 'manage_options' ) && isset($_REQUEST['filename']))
 			{
 				$js_url =get_bloginfo('template_directory');
 				$upload_d = wp_upload_dir();
 				$upload_url=$upload_d['baseurl'];
 				$upload_dir=$upload_d['basedir'];
-				$filename= $upload_dir."/ipblc_csv/".$_REQUEST['filename'];
+				$file_req=$_REQUEST['filename'];
+
+				//---remove ../ or ./ from direct access---
+
+				$file_req=str_replace("../","",$file_req);
+				$file_req=str_replace("./","",$file_req);
+
+				$filename= $upload_dir."/ipblc_csv/".$file_req;
+
+
 				//echo "file: $filename<BR>";
+
+				$exp=explode(".",$filename);
+				$ext=strtolower($exp[count($exp)-1]);
 				$row = 1;
-				if (($handle = fopen("$filename", "r")) !== FALSE)
-				{
-					$AllData=array();
-					while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
+				$file_type=filetype($filename);
+				
+				if($ext=="csv" && $file_type=="file")
+				{ 
+					if (($handle = fopen("$filename", "r")) !== FALSE)
+					{
+						$AllData=array();
+						while (($data = fgetcsv($handle, 5242880, ",")) !== FALSE)
+						{
+							$field=$data[0];
+							$value=$data[1];
+							$AllData[]=array("$field"=>$value);
+						}
+						fclose($handle);
+						echo json_encode($AllData);
+					}
+					else
 					{
-						$field=$data[0];
-						$value=$data[1];
-						$AllData[]=array("$field"=>$value);
+						echo "-1";
 					}
-					fclose($handle);
-					echo json_encode($AllData);
 				}
 				else
 				{

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -4,7 +4,7 @@ Donate link:
 Tags: comments, spam, IP, blacklist, cloud, IP cloud, block, spamming, secure, failed login, hack attempt, auto block login
 Requires at least: 3.3
 Tested up to: 4.1.1
-Stable tag: 3.42
+Stable tag: 3.43
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -91,6 +91,9 @@ http://demo.ip-finder.me/demo-details/
 
 == Changelog ==
 
+= 3.43 =
+* Quick Fix - Fixed CSV import vulnerability found by g0blin
+
 = 3.42 =
 * Quick Fix - Fixed mysql_real_escape_string() warning
 

programming_language: Markdown