WordPress Hacklog DownloadManager plugin <=2.1.4 - CSRF naar willekeurige bestandsupload kwetsbaarheid

The impact of this vulnerability is severe. A successful exploit allows an attacker to upload a web shell, effectively granting them remote code execution (RCE) on the affected server. This can lead to complete system takeover, data theft, modification, or deletion, and the installation of malware. The attacker could also leverage the compromised server to launch further attacks against other systems within the network, significantly expanding the blast radius. The ability to upload arbitrary code makes this a high-priority vulnerability requiring immediate attention.

WordPress websites utilizing Hacklog DownloadManager, particularly those running older, unpatched versions (≤2.1.4), are at significant risk. Shared hosting environments are especially vulnerable as they often lack the ability to directly update plugins, making users reliant on hosting provider intervention. Sites with weak security configurations or those that haven't implemented robust input validation are also at increased risk.

• wordpress / composer / npm:

grep -r 'hacklog_download_manager/includes/upload.php' /var/www/html/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/hacklog-download-manager/includes/upload.php | grep -i 'content-type: multipart/form-data'

• wordpress / composer / npm:

wp plugin list | grep hacklog-download-manager

1. 2024-11-19Disclosure

   disclosure

1. Gereserveerd2024-11-11
2. Gepubliceerd2024-11-19
3. Gewijzigd2024-11-20
4. EPSS bijgewerkt2026-04-02

The primary mitigation is to upgrade Hacklog DownloadManager to version 2.1.5 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include implementing strict Content Security Policy (CSP) headers to restrict script execution from untrusted sources. Additionally, implement robust input validation and sanitization on all user-supplied data to prevent malicious code from being injected. Monitor web server access logs for suspicious activity, particularly attempts to upload files to unexpected locations. After upgrading, confirm the fix by attempting to trigger the CSRF vulnerability using a known payload and verifying that the upload is blocked.