W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling
Strategic Overview
Vulnerability Overview
The W3 Total Cache plugin for WordPress is vulnerable to authorization bypass due to the use of loose comparison on the nonce value in the /pub/apc.php file. This affects versions up to, and including, 0.9.4.1. This makes it possible for attackers to bypass nonce protections if a valid nonce starts with 0e. In the right situation this bypass can be used to empty the OPCache.
Technical Analysis
REMEDIATION: Update to version 0.9.5, or a newer patched version --- IDENTIFIER: CWE-305 (Authentication Bypass by Primary Weakness) The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C