Ninja Forms Contact Form <= 2.9.27 - CSV Injection

2015-09-30 00:00
Smit B. Shah

Strategic Overview

Status
Patched in 2.9.28
Affected Plugin
Ninja Forms – The Contact Form Builder That Grows With You
Affected Version
<= 2.9.27
CVSS
8.4High
Weakness type
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVE
CVE pending
View all Ninja Forms – The Contact Form Builder That Grows With You vulnerabilities

At a glance

This record tracks a high-severity Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the Ninja Forms WordPress plugin, affecting versions <= 2.9.27. It carries a CVSS score of 8.4 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). The issue is fixed in version 2.9.28; sites on affected versions should update now. Disclosed September 2015, reported by Smit B. Shah.

Vulnerability Overview

The Ninja Forms Contact Form plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.9.27 via the export() function. This allows authenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Remediation

Update to version 2.9.28, or a newer patched version

How does WordSec protect against this?

The attempt arrives as an ordinary request to Ninja Forms: WordSec's web application firewall inspects request payloads before WordPress loads them. None of that substitutes for the fix: Ninja Forms 2.9.28 closes this, and updating the plugin is the step that ends it.

  • Firewall
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/39b6a1c7-2f8a-49e9-8807-a53a25524018

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C