WordPress Sniplets Vulnerabilities

This is one of the few HIGHLY CRITICAL security bulletins I’ve seen. The security firm NBBN has discovered some vulnerabilities within the WordPress Sniplets plugin which could be exploited to conduct cross-site scripting attacks, disclose sensitive information, or compromise a vulnerable system.

The security bulletin outlines the following configurations in which this plugin can be exploited:

1) Input passed to the “libpath” parameter in modules/syntax_highlight.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

Successful exploitation of this vulnerability requires that “register_globals” is enabled.

2) Input passed to the “text” parameter in modules/execute.php is not properly sanitised before being used in a call to “eval()”. This can be exploited to inject and execute arbitrary PHP code via a specially crafted parameter value.

Successful exploitation of this vulnerability requires that “register_globals” is enabled.

3) Input passed to the “page” parameter in view/admin/pager.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

4) Input passed to the “text” parameter in view/sniplets/warning.php, view/sniplets/notice.php, view/sniplets/inset.php, and modules/execute.php and “url” in view/admin/submenu.php is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.

Successful exploitation of this vulnerability requires that “register_globals” is enabled

Version 1.2.2 has been confirmed to contain these security problems as 1.2.2 happens to be the most current release of the software. The solution to this problem is to either edit the source code to ensure that input is properly verified and sanitized or, disable the plugin until an update has been released.

It appears as though people are already actively exploiting this plugin as Flopping Aces describes on his website.