PT-2017-12154 · Innovatech · Wp Rocket

Published 2017-07-26 · Updated 2017-08-04 · CVE-2017-11658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Rocket plugin version 2.9.3

Description The issue concerns the Local File Inclusion mitigation technique in the WP Rocket plugin, which trims traversal characters (..) but is insufficient to prevent remote attacks. This weakness can be exploited by using 0x00 bytes, as shown in a .%00.../.%00.../ attack.

Recommendations For WP Rocket plugin version 2.9.3, consider disabling the Local File Inclusion feature until a patch is available to prevent potential remote attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-11658

Affected Products

Wp Rocket

References · 5

• 🔥 https://gist.github.com/Shinkurt/157dbb3767c9489f3d754f79b183a890 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-11658 · Security Note
• https://wp-rocket.me/changelog · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11658 · Vendor Advisory
• https://wpvulndb.com/vulnerabilities/8872 · Note