Arbitrary File Deletion in Printcart Web to Print Product Designer for WooCommerce

Executive Summary

The vulnerability exists in the Printcart Web to Print Product Designer plugin for WooCommerce on WordPress, specifically in versions up to and including 2.5.2.

It is caused by insufficient path validation in the store_design_data() function, which uses a user-supplied 'nbd_item_key' POST parameter that is only sanitized with sanitize_text_field(). This sanitization does not remove path traversal sequences.

As a result, an attacker can manipulate the file path and cause arbitrary file deletion on the server by exploiting the Nbdesigner_IO::delete_folder() and PHP's rename() functions.

Additionally, the nonce protecting the nbd_save_customer_design AJAX action can be obtained by unauthenticated users via the nbd_check_use_logged_in endpoint, allowing unauthenticated attackers to perform these actions.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if the Printcart Web to Print Product Designer for WooCommerce plugin is installed and running a version up to and including 2.5.2.

Since the vulnerability exploits the 'nbd_save_customer_design' AJAX action with a nonce obtainable via the 'nbd_check_use_logged_in' endpoint, monitoring for unusual POST requests to these endpoints may help detect exploitation attempts.

Commands to detect the vulnerable plugin version on your WordPress installation could include:

• Using WP-CLI to check plugin version: wp plugin list --status=active | grep printcart
• Searching plugin files for the vulnerable function: grep -r 'store_design_data' wp-content/plugins/printcart-web-to-print-product-designer/
• Monitoring web server logs for POST requests to 'wp-admin/admin-ajax.php' with action=nbd_save_customer_design or calls to 'nbd_check_use_logged_in' endpoint.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to delete arbitrary files on the affected website's server.

Such arbitrary file deletion can lead to denial of service by removing critical files, and potentially enable remote code execution if important files are deleted or manipulated.

The CVSS score of 9.1 indicates a high severity impact with low attack complexity and no privileges or user interaction required.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Printcart Web to Print Product Designer for WooCommerce plugin to a version later than 2.5.2 where this vulnerability is fixed.

If an update is not immediately available, restrict access to the vulnerable AJAX endpoints by implementing authentication or IP-based restrictions to prevent unauthenticated attackers from obtaining the nonce.

Additionally, monitor and audit server logs for suspicious activity related to file deletion or unexpected POST requests targeting the vulnerable endpoints.

Consider applying web application firewall (WAF) rules to block path traversal attempts and unauthorized AJAX calls.

Useful 0 Not Useful 0