It is possible to gain Unauthenticated Remote Code Execution (RCE) on any WordPress instance that is using this plugin due to the unsafe use of maybe_unserialize for the parsing of unsanitised user input, via the cookie thimpress_hotel_booking_1 used within includes/class-wphb-sessions.php
CVE: CVE-2020-29047
Severity: HIGH
Vulnerability Type: CWE-502: Deserialization of Untrusted Data
Requires Authentication: No
Discovered: 2020-11-17 – Nick Blundell, AppCheck Ltd
Contacted Vendor: 2020-11-17
Reported to Vendor: 2020-11-18
Fixed: 2020-12-08
Name: WP Hotel Booking
URL: https://wordpress.org/plugins/wp-hotel-booking/
Vendor: Thimpress (https://thimpress.com/)
Vulnerable versions: < 1.10.3
Google Dork: inurl:”/wp-content/plugins/wp-hotel-booking/”
The following code deserialises the cookie value sent from the user, such that arbitrary code may be injected:
// File: includes/class-wphb-sessions.php
public function load() {
if ( isset( $_SESSION[ $this->prefix ] ) ) {
return $_SESSION[ $this->prefix ];
} else if ( $this->remember && isset( $_COOKIE[ $this->prefix ] ) ) {
return $_SESSION[ $this->prefix ] = maybe_unserialize( $_COOKIE[ $this->prefix ] );
} // ^^^^^^^^^^^^^^^^^
return array();
}
Exploitation of PHP serialisation vulnerabilities involves leveraging a collection of gadget classes that are already present within the vulnerable application, such as third party libraries, in such a way that arbitrary code execution (or some other malicious action) is executed when that chain of gadget classes is deserialised. See references below for more details on this class of vulnerability and its exploitation.
Please update to the latest version of the plugin.
AppCheck is a software security vendor based in the UK, that offers a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network, and cloud infrastructure.
As always, if you require any more information on this topic or want to see what unexpected vulnerabilities AppCheck can pick up in your website and applications then please get in contact with us: info@localhost
No software to download or install.
Contact us or call us 0113 887 8380
AppCheck is a software security vendor based in the UK, offering a leading security scanning platform that automates the discovery of security flaws within organisations websites, applications, network and cloud infrastructure. AppCheck are authorized by te Common Vulnerabilities and Exposures (CVE) Program aas a CVE Numbering Authority (CNA)
