Description
The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WP Cloud Plugins/_deleeuw_ Use-your-Drive | Google Drive plugin for WordPress
Default version status: unaffected
2.0 to ≤ 3.8.3affected
_DeLeeuw_ Share-one-Drive | OneDrive & SharePoint plugin for WordPress
Default version status: unaffected
2.0 to ≤ 3.8.3affected
_DeLeeuw_ WP Cloud Plugins - Box (Lets-Box)
Default version status: unaffected
2.0 to ≤ 3.8.3affected
_DeLeeuw_ WP Cloud Plugins - Dropbox (Out-of-the-Box)
Default version status: unaffected
2.0 to ≤ 3.8.3affected