An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.

One of the checks for 'override-antispoof' permission in the AntiSpoof extension is inverted, here: https://github.com/wikimedia/mediawiki-extensions-AntiSpoof/blob/7a5fc55dc31a0ab654a80a0fa6293027293c5b7c/includes/AntiSpoofPreAuthenticationProvider.php#L145

This might not be a real security issue – it looks like the faulty code path is only used for displaying UI messages (JS checks on Special:CreateAccount), and not for actually creating accounts. But I didn't go through everything to prove that for sure, so I'm filing as a security task just in case.

It's also not reproducible on Wikimedia wikis, because the anti-spoof checks there are handled by code in CentralAuth, which doesn't have the bug: https://github.com/wikimedia/mediawiki-extensions-CentralAuth/blob/061b493dc96a874bb49e1e67c10e416fce6040be/includes/CentralAuthPrimaryAuthenticationProvider.php#L512

This has been introduced in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AntiSpoof/+/618623, by accidentally removing a ! to negate a condition.

I discovered the problem while testing a patch for T167163.

CVE-2022-28209: ⚓ T304126 One of the checks for 'override-antispoof' permission is inverted (CVE-2022-28209)

Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.

变更日志如下：

*   新增 resources 目录。
*   新增游客访问设置，可设定展示静态页、展示自宝义内容或重定向到指定链接。
*   新增秘密登录设置，可设定密钥有效期。
*   合并或修复来自 burpheart/NexusPHP\_safe 及 CVE 网站上列出的一些安全隐患。
*   修复邮件乱码。

resources 目录用于存放一些资源文件，如模版。

游客访问，支持以下 4 种配置：

*   正常。也即默认的正常访问。
*   展示静态页面。展示存放于 resources/static-pages/ 目录下的静态页面。
*   展示自定义内容。通过富文本编辑要展示给游客的内容。
*   重定向到指定 URL。进行重定向操作。

秘密登录，启用后需要通过 URL 传递密钥参数才可登录。这里参数名为 secret。

**文章导航**

CVE-2020-24771: NexusPHP v1.6.0-beta2 – NexusPHP

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[day\] \[month\] \[year\] \[list\]

Date: Tue, 25 Jan 2022 17:55:25 +0000
From: Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>
To: oss-security@...ts.openwall.com
Cc: Linus Torvalds <torvalds@...ux-foundation.org>,
 Dave Airlie <airlied@...il.com>, Daniel Vetter <daniel@...ll.ch>,
 Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Marian Rehak <mrehak@...hat.com>
Subject: Linux kernel: Security sensitive bug in the i915 kernel driver​ (CVE-2022-0330)


\[This is a public disclosure of an issue reported 7 days ago to 
linux-distros at openwall. CVE-2022-0330 has been assigned to the 
issue since.\]

Hi all,

A missing GPU TLB flush has been discovered in the i915 kernel driver 
which could be exploited by malicious userspace and can manifest in two 
flavours, depending on whether the GPU is running behind an active IOMMU 
(address translation) or not:

1. IOMMU with address translation - malicious userspace can trigger DMAR 
read/write faults getting logged to the kernel log.

2. Without an active IOMMU malicious userspace can gain access (from the 
code executing on the GPU) to random memory pages.

Second case is therefore the serious one.

It is currently not known whether specific memory could be targeted, but 
random memory corruption or data leaks are a known possibility.

Underlying reason for the access to memory not owned is a missing TLB 
flush upon releasing memory which used to back a GPU buffer object back 
to the system.

Flawed assumption was that flushing the TLB at the start of every 
userspace GPU execution is sufficient, given the programming model where 
userspace is expected to declare which graphics virtual memory address 
ranges it will be accessing at the start of every execution. However 
what was not considered is that userspace can legitimately (it is 
allowed in uapi) \_not\_ declare those accesses.

This allows userspace to continue GPU access to memory, while the kernel 
driver (i915) is unaware of it being in use, and therefore is allowed to 
release the backing store back to the system. Should the system then 
give out those pages back for a different use, the exploit situation can 
arise.

Return of the pages back to the system can either be specifically 
engineered by the malicious software, or can happen innocently via 
system memory pressure.

All Intel integrated and discrete GPUs starting from Gen8 (Broadwell) 
are affected.

Fix has already been developed and consists of explicitly flushing the 
TLBs before releasing memory back to the system for any GPU buffer 
objects which were in use from the GPU.

Note that this will have a varying performance impact depending on the 
specific GPU, GPU workload and overall system workload.

Fix for the issue has been provided to the Linus distributions and Linux 
kernel maintainers and is expected to be merged to top of the tree and 
stable and LTS releases shortly. Fix carries the title of "drm/i915: 
Flush TLBs before releasing backing store".

Kind regards,

Tvrtko

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2022-0330: security - Linux kernel: Security sensitive bug in the i915 kernel driver​ (CVE-2022-0330)

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[day\] \[month\] \[year\] \[list\]

Date: Thu, 10 Feb 2022 14:16:41 +0000
From: Samuel Page <samuel.page@...gate.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2022-0435: Remote Stack Overflow in Linux Kernel TIPC Module
 since 4.8 (net/tipc)


Immunity Security Advisory

CVE-2022-0435: A Remote Stack Overflow in The Linux Kernel


========================================================================
Contents
========================================================================

Summary
Analysis
Further Information
Remediation
Acknowledgements
Disclosure Timeline


========================================================================
Summary
========================================================================

We discovered a remotely & locally reachable stack overflow in the Linux
kernel networking module for the Transparent Inter-Process
Communication (TIPC) protocol.

While the module can be found in most major distributions, it must be
loaded in order to be exploited. Furthermore, for remote exploitation
the target would need to have a TIPC bearer set up already i.e.
vulnerability extends to systems using TIPC.

Exploitation is trivial and can lead to denial of service via kernel
panic. In the absence, or bypass, of stack canaries/KASLR the
vulnerability can lead to control flow hijacking with an arbitrary
payload.

The vulnerability has been present since the introduction of the TIPC
monitoring framework in kernel version 4.8.

- Introduced: commit 35c55c9877f8 ("tipc: add neighbor monitoring framework")
- Fixed: https://github.com/torvalds/linux/commit/9aa422ad326634b76309e8ff342c246800621216

========================================================================
Analysis
========================================================================

Transparent Inter Process Communication (TIPC) is an IPC mechanism
designed for intra-cluster communication. Cluster topology is managed
around the concept of nodes and the links between these nodes.

One of the many features of the TIPC module is its monitoring framework.
Introduced into the kernel in June 2016 (commit 35c55c9), the framework
allows nodes to monitor network topology and share their view with other
nodes in the same domain.

Peer state is tracked via \`struct tipc\_peer\`:

...
    /\* struct tipc\_peer: state of a peer node and its domain
     \* @addr: tipc node identity of peer
     \* @head\_map: shows which other nodes currently consider peer 'up'
     \* @domain: most recent domain record from peer
     \* @hash: position in hashed lookup list
     \* @list: position in linked list, in circular ascending order by 'addr'
     \* @applied: number of reported domain members applied on this monitor list
     \* @is\_up: peer is up as seen from this node
     \* @is\_head: peer is assigned domain head as seen from this node
     \* @is\_local: peer is in local domain and should be continuously monitored
     \* @down\_cnt: - numbers of other peers which have reported this on lost
     \*/
    struct tipc\_peer {
        u32 addr;
        struct tipc\_mon\_domain \*domain;
        struct hlist\_node hash;
        struct list\_head list;
        u8 applied;
        u8 down\_cnt;
        bool is\_up;
        bool is\_head;
        bool is\_local;
    };
...

\`struct tipc\_mon\_domain\` referends a domain record, used to define that
peers view of the TIPC topology:

...
    #define MAX\_MON\_DOMAIN       64
    ...

    /\* struct tipc\_mon\_domain: domain record to be transferred between peers
     \* @len: actual size of domain record
     \* @gen: current generation of sender's domain
     \* @ack\_gen: most recent generation of self's domain acked by peer
     \* @member\_cnt: number of domain member nodes described in this record
     \* @up\_map: bit map indicating which of the members the sender considers up
     \* @members: identity of the domain members
     \*/
    struct tipc\_mon\_domain {
        u16 len;
        u16 gen;
        u16 ack\_gen;
        u16 member\_cnt;
        u64 up\_map;
        u32 members\[MAX\_MON\_DOMAIN\];
    };
...

These records are transferred between peers, with each node keeping a
copy of the most up-to-date domain record received from each of its
peers in the \`tipc\_peer->domain\` field.

Records are processed by the function \`tipc\_mon\_rcv\`, which check
\`STATE\_MSG\` received from peers, to see if the message body contains a
valid \`struct tipc\_mon\_domain\`:

...
    /\* tipc\_mon\_rcv - process monitor domain event message
     \*
     \* @data: STATE\_MSG body
     \* @dlen: STATE\_MSG body size (taken from TIPC header)
     \*/
    void tipc\_mon\_rcv(struct net \*net, void \*data, u16 dlen, u32 addr,
        struct tipc\_mon\_state \*state, int bearer\_id)
    {
        ...
        struct tipc\_mon\_domain \*arrv\_dom = data;
        struct tipc\_mon\_domain dom\_bef;
        ...

        /\* Sanity check received domain record \*/                        \[0\]
        if (dlen < dom\_rec\_len(arrv\_dom, 0))                             \[1\]
            return;
        if (dlen != dom\_rec\_len(arrv\_dom, new\_member\_cnt))               \[2\]
            return;
        if (dlen < new\_dlen || arrv\_dlen != new\_dlen)                    \[3\]
            return;
        ...

        /\* Drop duplicate unless we are waiting for a probe response \*/
        if (!more(new\_gen, state->peer\_gen) && !probing)                 \[4\]
            return;
        ...

        /\* Cache current domain record for later use \*/
        dom\_bef.member\_cnt = 0;
        dom = peer->domain;
        if (dom)                                                         \[5\]
            memcpy(&dom\_bef, dom, dom->len);                             \[6\]

        /\* Transform and store received domain record \*/
        if (!dom || (dom->len < new\_dlen)) {
            kfree(dom);
            dom = kmalloc(new\_dlen, GFP\_ATOMIC);                         \[7\]
            peer->domain = dom;
            if (!dom)
                goto exit;
        }
...

The function does some basic sanity checks \[0\] to make sure that a) the
message body actually contains a domain record and b) does it contain a
valid \`struct tipc\_mon\_domain\`.

Where \`data\` is the message body and \`dlen\` is the length of the \`data\`
taken from the message header, the function checks:

- the length of \`data\` is enough to at least hold an empty record \[1\]
- the length of \`data\` matches the expected size of a domain record
  given the provided \`member\_cnt\` field \[2\]
- the length of \`data\` matches the provided \`len\` field \[3\]

Later we fetch the sending peers \`struct peer\` to see if we've already
received a domain record from them \[5\]. If we have, we want to
temporarily cache a copy of the old record to do a comparison later \[6\].

Then, satisfied it's a new and valid record, we'll update the
\`struct peer->domain\` field with the new info. If it's the first domain
record, we'll make a new \`kmalloc\`ation for this \[7\], or if it's larger
than the last one we'll reallocate it.

-----------------
The Vulnerability
-----------------

The vulnerability lies in the fact that during the initial sanity
checks, the function doesn't check that \`member\_cnt\` is below
MAX\_MON\_DOMAIN which defines the maximum size of the \`members\` array.

By pretending to be a peer node and establishing a link with the target,
locally or remotely, we're able to first submit a malicious domain
record containing an arbitrary payload; so long as the len/member\_cnt
fields match up for the sanity checks, this will be kmallocated fine.

Next, we can send a newer domain record which will cause the previous
malicious record to be memcpy'd into a 272 bytes local
\`struct tipc\_mon\_domain\` &dom\_bef \[6\] triggering a stack overflow.

This allows us to overwrite the contents of the stack following
&dom\_bef with our arbitrary members buffer from the malicious domain
record submitted first; the size of which is constrained by the media
MTU (Ethernet, UDP, Inifiband)


========================================================================
Further Information
========================================================================

For a more in-depth analysis, including additional TIPC background, we
will be posting up a follow-up blog to compliment this advisory.

Regarding exploitation, after time has been given for patching and
remediation we will also release a further post discussing exploitation.

Further information will be posted over at https://twitter.com/immunityinc/

========================================================================
Remediation
========================================================================

This vulnerability has been present since the monitoring framework was
first introduced in June 2016, impacting versions 4.8 forward.

The patch below was introduced in commit 9aa422ad3266, so updating your
system to include this patch is the best way to mitigate CVE-2022-0435,
including an additional u16 overflow spotted by Eric Dumazet.

The TIPC module must be loaded for the system to be vulnerable,
furthermore to be targeted remotely the system needs to have a TIPC
bearer enabled. If you don't need to use TIPC or are unsure if you are,
you can take the following steps:

- \`$ lsmod | grep tipc\` will let you know if the module is currently
  loaded,
- \`modprobe -r tipc\` may allow you unload the module if loaded,
  however you may need to reboot your system
- \`$ echo "install tipc /bin/true" >> /etc/modprobe.d/disable-tipc.conf\`
  will prevent the module from being loaded, which is a good idea if you
  have no reason to use it

If you need to use TIPC and can't immediately patch your system, look to
enforce any configurtions that prevent or limit the ability for
attackers to imitate nodes in your cluster. Options include TIPC
protocol level encryption, IPSec/MACSec, network seperation etc.

It's also worth noting that the current \`CONFIG\_FORTIFY\_SRC=y\` is a hard
mitigation to leveraging CVE-2022-0435 for control-flow hijacking, as it
does a bounds check on the size of the offending memcpy and causes a
kernel panic.


========================================================================
Acknowledgements
========================================================================

I'd like to thank the maintainers of the TIPC module, as well as members
of the security@...nel.org and linux-distros@...openwall.org for their
help and work throughout the disclosure process.

I would also like to mention the vulnerability research done on TIPC
previously by SentinelLabs with their work on CVE-2021-43267 and other
security researchers for publishing their findings on TIPC exploitation.

- https://www.sentinelone.com/labs/tipc-remote-linux-kernel-heap-overflow-allows-arbitrary-code-execution/
- https://haxx.in/posts/pwning-tipc/

========================================================================
Disclosure Timeline
========================================================================

- 27/01/2022: Vulnerability & fix suggestion reported
- 05/02/2022: The patch is finalised
- 10/02/2022: Coordinated release date (14:00 GMT)

The information contained in this electronic mail is confidential information intended only for the use of the individual(s) or entity(s) named. If the reader of the message is not the addressee (or authorized to receive for the addressee), you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by reply e-mail and/or by telephone and destroy the original message.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2022-0435: security - CVE-2022-0435: Remote Stack Overflow in Linux Kernel TIPC Module since 4.8 (net/tipc)

A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-25574: douphp · Issue #1 · aqianhei/aqian

phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functionality.

**Nossos números:**

**3,5MM+**Anomalias reportadas  
aos clientes em 2020**450+**Pessoas em Recife, São  
Paulo, Rio e Londres**500+**Clientes no Brasil, UK,  
LATAM e Europa**21+**Anos de experiência  

**Principais Serviços**

 

**Security Consulting**

Projetos de avaliações, testes e diagnósticos de resiliência e cibersegurança.

Saiba Mais

 

**Security Integration**

Desenhamos, instalamos e configuramos as soluções de segurança próprias e de parceiros, respeitando o fluxo do seu negócio.

Saiba Mais

 

**Managed Security Services**

Temos inteligência, tecnologias e profissionais altamente qualificados para apoiar sua empresa com projetos contínuos.

Saiba Mais

 

**Digital Identity**

O AllowMe agrega proteção e confiança à relação digital entre empresas e seus clientes.

Saiba Mais

**Trabalhamos com importantes parceiros de negócios para oferecer as melhores ferramentas em cibersegurança.**

Nosso portfólio de ponta a ponta inclui as soluções tecnológicas mais inovadoras do mercado desenvolvidas pelos maiores fabricantes internacionais.

Saiba mais

Assine nossa newsletter

Cadastre-se para receber novidades

CVE-2021-46426: Home - Tempest - Líder em Segurança Digital no Brasil!

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[thread-next>\] \[day\] \[month\] \[year\] \[list\]

Date: Wed, 23 Mar 2022 20:49:49 -0700
From: Tavis Ormandy <taviso@...il.com>
To: oss-security@...ts.openwall.com
Subject: zlib memory corruption on deflate (i.e. compress)

Greetings list, I was recently trying to track down a reproducible crash
in a compressor. Believe it or not, it really was a bug in
zlib-1.2.11 when compressing (not decompressing!) certain inputs.

I reported it upstream, but it turns out the issue has been public since
2018, but the patch never made it into a release. As far as I know,
nobody ever assigned it a CVE.

https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531

As far as I can tell, no distros have picked this up.

Tavis.


-- 
 \_o)            $ lynx lock.cmpxchg8b.com
 /\\\\  \_o)  \_o)  $ finger taviso@....org
\_\\\_V \_( ) \_( )  @taviso

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2018-25032: security - zlib memory corruption on deflate (i.e. compress)

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters  found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.

On November 11, 2021 the Wordfence Threat Intelligence team initiated the responsible disclosure process for a vulnerability we discovered in “Photoswipe Masonry Gallery”, a WordPress plugin that is installed on over 10,000 sites. This flaw makes it possible for an authenticated attacker to inject malicious JavaScript that executes whenever a site administrator accesses the PhotoSwipe Options page or a user accesses a page with a gallery created by the plugin.

All Wordfence users, including users of our Free, Premium, Care, and Response products are protected from exploits targeting this vulnerability thanks to the Wordfence Firewall’s built-in Cross-Site Scripting (XSS) protection.

We attempted to reach out to the developer day on November 11, 2021, the same day we discovered the vulnerability. We never received a response after a couple of follow-ups so we sent the full details to the WordPres.org plugins team on November 20, 2021. The plugin was fully patched on January 14, 2022.

We strongly recommend ensuring that your site has been updated to the latest patched version of “Photoswipe Masonry Gallery”, which is version 1.2.18 at the time of this publication.

**Description:** Authenticated Stored Cross-Site Scripting  
**Affected Plugin:** Photoswipe Masonry Gallery  
**Plugin Slug:** photoswipe-masonry  
**Plugin Developer:** Web Design Gold Coast  
**Affected Versions:** <= 1.2.14  
**CVE ID:** CVE-2022-0750  
**CVSS Score:** 6.4 (Medium)  
**CVSS Vector:** CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N  
**Researcher/s:** Chloe Chamberland  
**Fully Patched Version:** 1.2.15

Photoswipe Masonry Gallery is a plugin designed to enhance gallery creation using the default WordPress gallery builder which can be added to WordPress pages and posts. As with many other plugins available in the WordPress repository, this plugin has the ability to set general options for the plugin. These settings translate over to any gallery that a site owner chooses to create and includes things like thumbnail width and height for images along with many other settings. Unfortunately, this plugin had a vulnerability that made it possible for attackers to modify these settings.

Diving deeper, the plugin registered an admin_menu action that hooked to the update function that controlled saving the plugins settings.

add\_action('admin\_menu', array('photoswipe\_plugin\_options', 'update'));

As with several other admin style hooks in WordPress, like wp_ajax, admin_post, and admin_init, the admin_menu hook checks to see if a user is accessing the administrative area of a site prior to loading the hooked function. It does not, however, validate that the user accessing the administrative area is an admin user. The admin_menu action does this to add additional menu pages to the administrative area of a WordPress site. This means that an authenticated user accessing the /wp-admin area of a vulnerable site will trigger the hook and ultimately execute the function associated with the hook. In this case that is the update function.

Due to the fact that the update function had no capability checks or nonce checks of it’s own, any authenticated user accessing the /wp-admin area of a vulnerable site could send a POST request with photoswipe_save set to true and update the settings of the plugin.

	public static function update() {

		if(isset($\_POST\['photoswipe\_save'\])) {

			$options = photoswipe\_plugin\_options::pSwipe\_getOptions();

			$options\['thumbnail\_width'\] = stripslashes($\_POST\['thumbnail\_width'\]);
			$options\['thumbnail\_height'\] = stripslashes($\_POST\['thumbnail\_height'\]);

			$options\['max\_image\_width'\] = stripslashes($\_POST\['max\_image\_width'\]);
			$options\['max\_image\_height'\] = stripslashes($\_POST\['max\_image\_height'\]);

Considering the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters had no sanitization or validation, attackers could inject malicious JavaScript into the plugin’s settings which would result in the malicious JavaScript executing anytime an administrator accessed the plugins setting page or a user accessed a gallery that was created with the plugin. This malicious JavaScript could be used to redirect site visitors accessing a gallery to malicious domains for further infection or inject new administrative user accounts if an administrator accessed a page containing the malicious payload. As such, it is important to verify that your site has been updated to the latest version as soon as possible.

**Timeline**

**November 11, 2021** – Conclusion of the plugin analysis that led to the discovery of a Stored Cross-Site Scripting Vulnerability in the “Photoswipe Masonry Gallery” plugin. We verify that the Wordfence Firewall provides sufficient protection. We attempt to initiate contact with the developer.  
**November 30, 2021** – After no response from the developer, we send the full disclosure details to the WordPress plugins team. They acknowledge the report and make contact with the developer.  
**January 4, 2022** – We follow-up with the plugins team asking about a missing capability check on the vulnerable function. They inform us that they have let the developer know and they will have a release out by the end of the month.  
**January 14, 2022** – A fully patched version of the plugin is released as version 1.2.15.

**Conclusion**

In today’s post, we detailed a flaw in the “Photoswipe Masonry Gallery” plugin that made it possible for authenticated attackers to inject malicious web scripts that will execute whenever a site owner accesses the PhotoSwipe Options page or a gallery created with the plugin, which could lead to complete site compromise. This flaw has been fully patched in version 1.2.15.

We recommend that WordPress site owners immediately verify that their site has been updated to the latest patched version available, which is version 1.2.18 at the time of this publication.

All Wordfence users, including users of our Free, Premium, Care, and Response products are protected from exploits targeting this vulnerability thanks to the Wordfence Firewall’s built-in Cross-Site Scripting (XSS) protection.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

CVE-2022-0750: Stored Cross-Site Scripting Vulnerability Patched in a WordPress Photo Gallery Plugin

The Advanced Contact form 7 DB WordPress plugin before 1.8.7 does not have authorisation nor CSRF checks in the acf7_db_edit_scr_file_delete AJAX action, and does not validate the file to be deleted, allowing any authenticated user to delete arbitrary files on the web server. For example, removing the wp-config.php allows attackers to trigger WordPress setup again, gain administrator privileges and execute arbitrary code or display arbitrary content to the users.

CVE-2021-24905

connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.

@@ -6794,14 +6794,22 @@ protected function getFullPath($path, $base)

$base = rtrim($base, $separator);

}

  

// 'Here'

if ($path === '' || $path === '.' . $separator) return $base;

  

$sepquoted = preg\_quote($separator, '#');

  

// normalize \`//\` to \`/\`

$path = preg\_replace('#' . $sepquoted . '+#', $separator, $path); // '#/+#'

  

// remove \`./\`

$path = preg\_replace('#(?<=^|' . $sepquoted . ')\\.' . $sepquoted . '#', '', $path); // '#(?<=^|/)\\./#'

  

// 'Here'

if ($path === '') return $base;

  

// join $base to $path if $path start \`../\`

if (substr($path, 0, 3) === '..' . $separator) {

$path = $base . $separator . $path;

}

  

// normalize \`/../\`

$normreg = '#(' . $sepquoted . ')\[^' . $sepquoted . '\]+' . $sepquoted . '\\.\\.' . $sepquoted . '#'; // '#(/)\[^\\/\]+/\\.\\./#'

while (preg\_match($normreg, $path)) {

@@ -6811,6 +6819,9 @@ protected function getFullPath($path, $base)

$path = rtrim($path, $separator);

}

  

// discard the surplus \`../\`

$path = str\_replace('..' . $separator, '', $path);

  

// Absolute path

if ($path\[0\] === $separator || strpos($path, $systemroot) === 0) {

return $path;

Tag

#php