Autoptimize <= 2.7.7 - Race Condition leading to Remote Code Execution

2020-10-09 00:00
Marcin Węgłowski

Strategic Overview

Status
Patched in 2.7.8
Affected PluginAutoptimize
Affected Version< 2.7.8
CVSS8.1High
CVECVE-2021-24377
View all Autoptimize vulnerabilities

Vulnerability Overview

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.

Technical Analysis

REMEDIATION: Update to version 2.7.8, or a newer patched version --- IDENTIFIER: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

External References

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C