PT-2018-15269 · WordPress · Wordpress

Sam Thomas · Published 2018-12-14 · Updated 2019-03-04 · CVE-2018-20148

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1

Description The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This allows contributors to conduct PHP object injection attacks via crafted metadata in a "wp.getMediaItem" XMLRPC call.

Recommendations For WordPress versions prior to 4.9.9, update to version 4.9.9 or later. For WordPress versions 5.x prior to 5.0.1, update to version 5.0.1 or later.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-20148

DLA-1673-1

DSA-4401-1

Affected Products

Wordpress

References · 43

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_crop_rce.rb · Exploit
• 🔥 https://github.com/brianwrf/WordPress_4.9.8_RCE_POC · Exploit
• 🔥 https://github.com/synacktiv/CVE-2019-8942 · Exploit
• 🔥 https://github.com/nth347/CVE-2018-20148_exploit · Exploit
• 🔥 https://blog.secarma.co.uk/labs/near-phar-dangerous-unserialization-wherever-you-are · Exploit
• https://wordpress.org/support/wordpress-version/version-5-0-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20150 · Security Note
• https://wpvulndb.com/vulnerabilities/9171 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20147 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1673-1 · Vendor Advisory
• https://debian.org/security/2019/dsa-4401 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-20148 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20151 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-20148 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4401-1 · Vendor Advisory