Arbitrary File Upload in '1 Flash Gallery' Wordpress Plugin

====Vulnerability====

The '1 Flash Gallery' WordPress plugin (http://wordpress.org/extend/plugins/1-flash-gallery/) is vulnerable to an arbitrary file upload vulnerability. This vulnerability is present from version 1.30 until version 1.5.7. The plugin has been downloaded an estimated 460,000 times, and as of yesterday was ranked by WordPress as the 17th most popular plugin. A patch was released today, so anyone who has this plugin installed should update immediately.

This vulnerability allows an attacker to plant a remote PHP file and thereby execute arbitrary code on the remote host by simply submitting the file via POST request to the following URI on a vulnerable installation:

/wp-content/plugins/1-flash-gallery/upload.php?action=uploadify&fileext=php

This works because the upload.php script a.) performs no authentication checks, b.) trusts a user-supplied request variable to provide allowed filetypes, and c.) does not actually validate that the file is a well-formed image file. I have only tested the vulnerability on an installation that does not perform watermarking, the default setting; it may or may not work on installations that do otherwise.

I have created a proof-of-concept Metasploit module demonstrating the vulnerability, which interested persons can download here: http://spareclockcycles.org/downloads/code/fgallery_file_upload.rb

Hosts can be found with the following Google search: inurl:"wp-content/plugins/1-flash-gallery"

====Disclosure====

I reported the vulnerability to both WordPress and the plugin developers yesterday, Sep 5 2011. Both responded quickly to the issue. WordPress temporarily took down the plugin until the patch was released, which the developers did later in the day. I 'd like to thank WordPress for their fast and professional response.

I am now releasing details of the vulnerability publicly to ensure that users are aware of the issue, and encourage them to update their plugins accordingly. The 1 Flash Gallery developers did not stress the severe implications of this vulnerability in their changelog (or mention that it was a security issue at all), so this post is partly to ensure that the implications are made clear. Personally, I would uninstall the plugin, given its history of serious security issues and the developers' lack of candor about those reported to them.

As always, questions/comments welcome.