Exploitation Summary
EIP tracks 2 public exploits for CVE-2016-6896.
PoCs published by Yorick Koster, Yorick Koster, CryptisStudents, including Metasploit module auxiliary/dos/http/wordpress_directory_traversal_dos.
AI-analyzed exploit summary The exploit demonstrates a path traversal vulnerability in WordPress Core Ajax handlers, specifically in the wp_ajax_update_plugin() function. It allows an authenticated user (Subscriber) to trigger a denial of service (DoS) by exhausting the entropy pool via repeated reads from /dev/random.
Description
Directory traversal vulnerability in the wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress 4.5.3 allows remote authenticated users to cause a denial of service or read certain text files via a .. (dot dot) in the plugin parameter to wp-admin/admin-ajax.php, as demonstrated by /dev/random read operations that deplete the entropy pool.
Exploits (2)
The exploit demonstrates a path traversal vulnerability in WordPress Core Ajax handlers, specifically in the wp_ajax_update_plugin() function. It allows an authenticated user (Subscriber) to trigger a denial of service (DoS) by exhausting the entropy pool via repeated reads from /dev/random.
This Metasploit module exploits a CSRF vulnerability in WordPress before 4.6 to perform a directory traversal DoS attack by sending multiple requests to read /dev/random, causing service disruption.
References (5)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H