In the WP Rocket plugin 2.9.3 for WordPress, the Local File Inclusion mitigation technique is to trim traversal characters (..) -- however, this is insufficient to stop remote attacks and can be bypassed by using 0x00 bytes, as demonstrated by a .%00.../.%00.../ attack.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890 | third party advisory exploit |
https://wp-rocket.me/changelog | release notes vendor advisory |
https://wpvulndb.com/vulnerabilities/8872 | vdb entry third party advisory |