Arbitrary File Upload in Blocksy Companion WordPress Plugin

Executive Summary

The Blocksy Companion plugin for WordPress has a vulnerability in versions up to and including 2.1.46 that allows arbitrary file uploads. This happens because the Custom Fonts extension uses a filter that approves any filename containing '.woff2' or '.ttf' anywhere in the name, rather than ensuring these are the actual file extensions. As a result, files with double extensions like 'shell.woff2.php' can bypass MIME type validation and be treated as allowed font files.

This flaw enables unauthenticated attackers to upload potentially executable files, which can lead to remote code execution on the affected system.

Note that this vulnerability is only exploitable when the premium version of the plugin (blocksy-companion-pro) is installed with both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions active. The free version of the plugin does not contain this vulnerable code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to upload arbitrary files that may be executable. This can lead to remote code execution, meaning attackers could run malicious code on your server.

Such an exploit could compromise the integrity, confidentiality, and availability of your website and server, potentially leading to data breaches, defacement, or full system takeover.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update the Blocksy Companion plugin and its premium version (blocksy-companion-pro) to a version later than 2.1.46 where the issue is fixed.

If updating is not immediately possible, disable the premium version of the plugin or deactivate both the WooCommerce Extra (Advanced Reviews) and Custom Fonts extensions, as the vulnerability is only exploitable when these are active.

Additionally, restrict file upload permissions and monitor for any suspicious file uploads, especially files with double extensions like .woff2.php.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the ability to upload files with double extensions such as shell.woff2.php that bypass MIME validation. Detection can focus on identifying suspicious uploaded files with double extensions or unusual file types in the WordPress uploads directory or wherever the Blocksy Companion plugin stores attachments.

• Search for files with suspicious double extensions like *.woff2.php or *.ttf.php in the uploads directory.
• Check web server logs for HTTP POST requests to the save_attachments function or upload endpoints related to the Blocksy Companion plugin.
• Use commands such as: find /path/to/wordpress/wp-content/uploads -type f -name '*.woff2.php' -o -name '*.ttf.php'
• Review recently uploaded files for unexpected extensions or executable code.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to upload potentially executable files, leading to remote code execution. This can result in unauthorized access, data breaches, or system compromise.

Such security breaches can impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.

Therefore, exploitation of this vulnerability could lead to violations of these regulations due to potential data exposure or loss of system integrity.

Useful 0 Not Useful 0