Directory Traversal in AR for WordPress Plugin

Executive Summary

The AR for WordPress plugin is vulnerable to a Directory Traversal attack in all versions up to and including 8.40. This vulnerability occurs via the 'file' parameter, allowing unauthenticated attackers to read arbitrary files on the server.

To exploit this vulnerability, an attacker must first obtain a valid nonce and secure nonce through publicly accessible AJAX handlers (ar_get_fresh_nonce and ar_process_user_image). They also need to reproduce the encryption key locally. Both steps are achievable by unauthenticated attackers on default free or unlicensed installations where the ar_licence_key is unset.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to read the contents of arbitrary files on the server without authentication. These files may contain sensitive information, which could lead to data exposure or leakage.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for attempts to exploit the 'file' parameter in the AR for WordPress plugin via the publicly accessible AJAX handlers ar_get_fresh_nonce and ar_process_user_image nopriv.

You can monitor web server logs for suspicious requests targeting these AJAX endpoints with unusual 'file' parameter values that attempt directory traversal patterns (e.g., ../ or ..\).

Example commands to detect such attempts include using grep on your web server access logs:

• grep -i 'ar_get_fresh_nonce' /var/log/apache2/access.log | grep -E '\.\./|\.\.\\'
• grep -i 'ar_process_user_image' /var/log/apache2/access.log | grep -E '\.\./|\.\.\\'

Additionally, scanning for the presence of the AR for WordPress plugin and verifying if the ar_licence_key is unset can help identify vulnerable installations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the AR for WordPress plugin to a version later than 8.40 where this vulnerability is fixed.

If an update is not immediately possible, restrict access to the vulnerable AJAX handlers (ar_get_fresh_nonce and ar_process_user_image) by implementing firewall rules or web server access controls to block unauthenticated requests.

Ensure that the ar_licence_key is properly set to prevent exploitation on default free or unlicensed installations.

Monitor logs for suspicious activity and consider disabling or removing the plugin if it is not essential.

Useful 0 Not Useful 0