Directory Traversal in PixMagix WordPress Plugin

Executive Summary

The PixMagix WordPress Image Editor plugin is vulnerable to a Directory Traversal attack in all versions up to and including 1.7.2. This vulnerability exists in the move_image_on_server function, where an unsanitized parameter ('layers[].id') is used to build a filesystem path. Because this parameter is not properly sanitized, an attacker with author-level access or higher can include traversal sequences like '../../' to escape the intended upload directory.

This allows the attacker to write files with attacker-controlled content to arbitrary locations on the server by exploiting the PHP copy() function call. The vulnerability is exploitable via the save_template REST endpoint, which requires permissions that author-level users have by default after the plugin is activated.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the exploitation of the 'layers[].id' parameter in the PixMagix WordPress Image Editor plugin to perform directory traversal and write files to arbitrary locations on the server.

To detect exploitation attempts on your system or network, you can monitor HTTP requests to the save_template REST endpoint for suspicious traversal sequences such as '../../' in the 'layers[].id' parameter.

Example commands to detect such attempts in web server logs include:

• Using grep to search for traversal patterns in access logs: grep -E "layers%5B.*%5D=\.\./\.\./" /var/log/apache2/access.log
• Searching for POST requests to the save_template endpoint: grep "POST /wp-json/pixmagix/v1/save_template" /var/log/apache2/access.log
• Combining both to find suspicious requests: grep "POST /wp-json/pixmagix/v1/save_template" /var/log/apache2/access.log | grep -E "layers%5B.*%5D=\.\./\.\./"

Additionally, monitoring file system changes for unexpected files in directories outside the intended upload path may help detect successful exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker with author-level access to write arbitrary files anywhere on the server where the web server process has write permissions. This could lead to unauthorized file creation or modification, potentially enabling further attacks such as web shell uploads, defacement, or other malicious activities.

Since the attacker can place files outside the intended upload directory, this may compromise the integrity and security of the server and the website.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Update the PixMagix WordPress Image Editor plugin to a version later than 1.7.2 where the vulnerability is fixed.
• Restrict author-level user permissions if possible, since the vulnerability requires author-level access or higher.
• Implement web application firewall (WAF) rules to block requests containing directory traversal patterns in the 'layers[].id' parameter.
• Monitor and audit server file system for unauthorized file writes.
• If immediate update is not possible, consider disabling or restricting access to the save_template REST endpoint.

Useful 0 Not Useful 0