CVE-2023-4634

The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Patrowl/CVE-2023-4634/	Exploit Third Party Advisory
https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz	Third Party Advisory VDB Entry
https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/	Exploit Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2023-09-06 09:15

Updated : 2023-11-07 04:22

NVD link : CVE-2023-4634

Mitre link : CVE-2023-4634

CVE.ORG link : CVE-2023-4634

JSON object : View

Products Affected

davidlingren

media_library_assistant

CWE

No CWE.

{"id": "CVE-2023-4634", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-09-06T09:15:08.873", "references": [{"url": "https://github.com/Patrowl/CVE-2023-4634/", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://packetstormsecurity.com/files/174508/wpmla309-lfiexec.tgz", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@wordfence.com"}, {"url": "https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/", "tags": ["Exploit", "Third Party Advisory"], "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2955933%40media-library-assistant&new=2955933%40media-library-assistant&sfp_email=&sfph_mail=#file4", "tags": ["Patch"], "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/05c68377-feb6-442d-a3a0-1fbc246c7cbf?source=cve", "tags": ["Third Party Advisory"], "source": "security@wordfence.com"}], "vulnStatus": "Modified", "descriptions": [{"lang": "en", "value": "The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible."}, {"lang": "es", "value": "El complemento Media Library Assistant para WordPress es vulnerable a la inclusi\u00f3n de archivos locales y la ejecuci\u00f3n remota de c\u00f3digo en versiones hasta la 3.09 incluida. Esto se debe a controles insuficientes en las rutas de archivo que se suministran al par\u00e1metro 'mla_stream_file' desde el archivo ~/includes/mla-stream-image.php, donde las im\u00e1genes se procesan a trav\u00e9s de Imagick(). Esto hace posible que atacantes no autenticados proporcionen archivos a trav\u00e9s de FTP que har\u00e1n posible las listas de directorios, la inclusi\u00f3n de archivos locales y la ejecuci\u00f3n remota de c\u00f3digo.\n"}], "lastModified": "2023-11-07T04:22:48.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:davidlingren:media_library_assistant:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "5C1D11EB-8D81-458F-972A-2143B2D66FB7", "versionEndExcluding": "3.10"}], "operator": "OR"}]}], "sourceIdentifier": "security@wordfence.com"}