W3 Total Cache <= 0.9.4.1 - Security Token Bypass via Type Juggling

2016-09-26 00:00
SecuPress

Strategic Overview

Status
Patched in 0.9.5
Affected Plugin
W3 Total Cache
Affected Version
<= 0.9.4.1
CVSS
3.7Low
Weakness type
CWE-305 · Authentication Bypass by Primary Weakness
CVE
CVE pending
View all W3 Total Cache vulnerabilities

At a glance

This record tracks a low-severity Authentication Bypass by Primary Weakness vulnerability in the W3 Total Cache WordPress plugin, affecting versions <= 0.9.4.1. It carries a CVSS score of 3.7 (reachable over the network). Exploitation requires no authentication. The issue is fixed in version 0.9.5; sites on affected versions should update now. Disclosed September 2016, reported by SecuPress.

Vulnerability Overview

The W3 Total Cache plugin for WordPress is vulnerable to authorization bypass due to the use of loose comparison on the nonce value in the /pub/apc.php file. This affects versions up to, and including, 0.9.4.1. This makes it possible for attackers to bypass nonce protections if a valid nonce starts with 0e. In the right situation this bypass can be used to empty the OPCache.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no privileges on the target site, and no interaction from a victim user.

CWE-305: Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Remediation

Update to version 0.9.5, or a newer patched version

How does WordSec protect against this?

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: W3 Total Cache 0.9.5 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/a07bc541-2113-43db-acdf-9ecb00dd50e9

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C