Arbitrary File Deletion in Image Optimizer WordPress Plugin

Executive Summary

The Image Optimizer plugin for WordPress has a vulnerability that allows an authenticated user with Author-level access or higher to delete arbitrary files on the server. This happens because the plugin does not properly validate file paths when deleting backup files. Specifically, it uses file paths stored in the image_optimizer_metadata post meta field without verifying that these paths are within the intended uploads directory.

An attacker can manipulate the image_optimizer_metadata field on their own attachments to inject absolute file paths. When the attachment is deleted, the plugin deletes files at those paths without checking if they are safe to delete, potentially removing critical files on the server.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for unauthorized or suspicious modifications to the image_optimizer_metadata post meta field in WordPress attachments, especially by users with Author-level access or higher.

Since the vulnerability exploits the ability to inject arbitrary absolute file paths into the backups array via the Custom Fields interface, monitoring changes to this metadata can help detect exploitation attempts.

There are no specific commands provided in the available resources to detect this vulnerability directly.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to serious impacts including denial of service, data loss, or security degradation. Because an attacker can delete arbitrary files on the server within the web server's filesystem permissions, important files or system components could be removed, disrupting the normal operation of the website or server.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated attackers with Author-level access to delete arbitrary files on the server, potentially leading to denial of service, data loss, or security degradation.

Such impacts on data integrity and availability could negatively affect compliance with standards and regulations like GDPR and HIPAA, which require protection of data against unauthorized alteration or destruction.

However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Image Optimizer plugin to a version later than 1.7.4 where this vulnerability is fixed.

Restrict Author-level user permissions to prevent unauthorized editing of the image_optimizer_metadata post meta field.

Monitor and audit changes to the image_optimizer_metadata post meta field to detect any suspicious activity.

If an update is not immediately possible, consider disabling or removing the plugin temporarily to prevent exploitation.

Useful 0 Not Useful 0