PT-2019-12172 · WordPress · Wp Live Chat Support

Published 2019-06-03 · Updated 2023-05-26 · CVE-2019-11185

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Live Chat Support Pro plugin versions through 8.0.26

Description The issue arises from an incomplete patch, resulting in an arbitrary file upload vulnerability. This vulnerability can be exploited by an unauthenticated remote user submitting a crafted file upload POST request to the "REST api remote upload endpoint". The exploit involves using a non-blacklisted executable file extension in conjunction with a whitelisted file extension and prepending "magic bytes" to the payload, allowing it to pass MIME checks and be classified as an image, despite having a trailing .phtml file extension.

Recommendations For WP Live Chat Support Pro plugin versions through 8.0.26, consider disabling the remote upload endpoint in the REST API until a patch is available. Restrict access to the plugin's file upload functionality to minimize the risk of exploitation. Avoid using the plugin's file upload feature until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11185

Affected Products

Wp Live Chat Support

References · 5

• 🔥 https://wpvulndb.com/vulnerabilities/9320 · Exploit
• https://wp-livechat.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11185 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11185 · Security Note
• https://wordpress.org/plugins/wp-live-chat-support/#developers · Note