Hello list! I want to inform you about vulnerability in Contact Form 7 plugin for WordPress. This is Code Execution via Arbitrary File Uploading vulnerability. ------------------------- Affected products: ------------------------- Vulnerable are Contact Form 7 3.5.2 and previous versions. After my informing developer released version 3.5.3 with a fix. ------------------------- Affected vendors: ------------------------- Contact Form 7 http://contactform7.com ---------- Details: ---------- Code Execution (WASC-31): Attack is going via uploader. For code execution it's needed to upload phtml (on web servers with PHP) or asp/aspx (on IIS) files. The attack can be made as by user with admin rights (to make appropriate contact form with uploader tag) and by unauthenticated user, if there is already appropriate contact form at web site (made by unsuspicious admin). For the first scenario the attack process will be the next. Attacker with admin access add uploader tag into contact form at the site and use it for CE via AFU attack. There must be uploader tag in contact form and it's needed to set allowed extension to it (because besides the list of forbidden extensions, the plugin also has the list of allowed extensions and there are no scripts among them). [file file-423 filetypes:phtml] The files are uploaded into folder: http://site/wp-content/uploads/wpcf7_uploads/ At creation of this folder the file .htaccess is created (with content: Deny from all). It can be bypassed at using of other web servers besides Apache (where .htaccess is ignored), or at Apache it's possible to use vulnerabilities in WP for file deletion, or via LFI vulnerability to include a file from this folder. ------------ Timeline: ------------ 2013.09.28 - announced at my site. 2013.10.01 - informed developer. 2013.10.03-21 - conversation with developer about this and other vulnerabilities in CF7. 2013.10.09 - plugin version 3.5.3 was released. 2013.11.21 - disclosed at my site (http://websecurity.com.ua/6799/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua