CVE-2022-41840 - Unauthorized Directory Traversal in Welcart eCommerce Plugin for WordPress

If you are using the Welcart eCommerce plugin for your WordPress-based online store, here's an important security update you shouldn't ignore. A new vulnerability with a CVE ID of CVE-2022-41840 has been discovered in the Welcart eCommerce plugin (version <= 2.7.7). This vulnerability allows unauthorized directory traversal, potentially giving attackers sensitive information or the ability to execute other exploits. This long read will help you understand the vulnerability, its implications, and what you can do to secure your online store.

Overview of CVE-2022-41840

Security researchers have identified an unauthorized Directory Traversal vulnerability in the Welcart eCommerce plugin for WordPress with a version <= 2.7.7. As a result, attackers can exploit this vulnerability to access sensitive files and directories outside the intended root directory. This could lead to attackers obtaining sensitive information, such as configuration files containing login credentials and other critical data, which could potentially be used for further attacks on your website.

Code Snippet

The vulnerable piece of code in question is found in the download.php file of the Welcart eCommerce plugin. Specifically, the plugin fails to adequately validate the input for the $filename parameter. As a result, an attacker can craft a malicious request to bypass the intended restrictions, allowing them to access sensitive files.

Here's a code snippet demonstrating this flaw

$filename = isset($_GET['wc_file']) ? $_GET['wc_file'] : '';
$usces->set_cart_fees($usces->cart->theid);
$cart = $usces->cart->get_cart();

//... omitted code ...

if(file_exists($filename)) {
    $mimetype = (!empty($wc_item['wc_filetype'])) ? $wc_item['wc_filetype'] : 'application/octet-stream';
    header('Content-Type: ' . $mimetype);
    header('Content-Disposition: attachment; filename="' . basename($filename) . '"');
    header('Content-Length: ' . filesize($filename));
    readfile($filename);
    exit;
}

Explaining the Exploit

As shown in the code snippet, the $filename parameter is directly constructed from the $_GET['wc_file'] input without any validation or sanitization. Consequently, an attacker can leverage this oversight by providing a crafted input containing directory-traversal payloads (e.g., using .. to move up in directories). This enables them to reach files outside the intended scope, potentially accessing sensitive files.

For example, a malicious request might look like this

http://your-website.com/wp-content/plugins/usc-e-shop/download.php?wc_file=../../../wp-config.php

In this example, the attacker is trying to access the wp-config.php file located in the root directory of your WordPress installation. If successful, they could get sensitive information, such as database credentials, salts, and more.

Original References

The vulnerability has been assigned a CVE ID of CVE-2022-41840. Security researchers and the plugin's developers have both acknowledged the vulnerability.

Here are some links to the original references

- CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41840
- WordPress Plugin Directory: https://wordpress.org/plugins/usc-e-shop/

Mitigation Steps

To mitigate this vulnerability and protect your online store from potential attacks, it's crucial to update the Welcart eCommerce plugin to the latest available version. The plugin developers have released a security update to address this vulnerability in version 2.8.. Ensure you update your plugin as soon as possible and regularly check for security updates to ensure your website remains safe from future exploits.

Conclusion

In conclusion, unauthorized Directory Traversal vulnerabilities, like CVE-2022-41840, can have severe implications on your online store's security. It's essential to understand the potential risks and keep your plugins and other software up-to-date to prevent attackers from exploiting such vulnerabilities. Make sure you update your Welcart eCommerce plugin to at least version 2.8. and monitor for new updates in the future to keep your online store secure.

Timeline

Published on: 11/18/2022 19:15:00 UTC
Last modified on: 11/21/2022 17:06:00 UTC