AddToAny Share Buttons <= 1.7.14 - HTTP Host Header Injection

2017-08-16 00:00
Paul Dannewitz

Strategic Overview

Status
Patched in 1.7.15
Affected Plugin
AddToAny Share Buttons
Affected Version
<= 1.7.14
CVSS
4.7Medium
Weakness type
CWE-20 · Improper Input Validation
CVE
CVE pending
View all AddToAny Share Buttons vulnerabilities

At a glance

This record tracks a medium-severity Improper Input Validation vulnerability in the AddToAny Share Buttons WordPress plugin, affecting versions <= 1.7.14. It carries a CVSS score of 4.7 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.7.15; sites on affected versions should update now. Disclosed August 2017, reported by Paul Dannewitz.

Vulnerability Overview

The AddToAny Share Buttons plugin for WordPress is vulnerable to Host Header Injections in versions up to, and including, 1.7.14. This is due to a failure to properly validate the HTTP request header. This makes it possible for unauthorized attackers to poison the website cache and log users credentials.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site.

CWE-20: Improper Input Validation

Reaching this weakness in AddToAny Share Buttons <= 1.7.14 takes a caller who can reach the endpoint. Improper input validation means the application accepts input without confirming it has the form, type or range the code downstream assumes.

The concrete impact depends on where the unvalidated value lands, which is why records in this class range from cosmetic bugs to full compromise. For AddToAny Share Buttons the fix is 1.7.15: builds <= 1.7.14 are affected, anything from 1.7.15 onward is not.

Remediation

Update to version 1.7.15, or a newer patched version

How does WordSec protect against this?

The attempt arrives as an ordinary request to AddToAny Share Buttons: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: AddToAny Share Buttons 1.7.15 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/7cc86970-7e63-47d0-9971-ddd0fc992a5a

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C