CVE-2024-9417: Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload
First published: Sat Oct 05 2024(Updated: )
The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validation in the 'handleUpload' function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to upload files that are excluded from both the 'allowedExtensions' and 'unallowed_extensions' arrays on the affected site's server, including files that may contain cross-site scripting.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hash Hash Form – Drag & Drop Form Builder | <=1.1.9 | |
| Hashthemes Hash Form | <1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cad7731a-1f81-4055-9b49-15b35edd3fcf?source=cve
- https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L107
- https://plugins.trac.wordpress.org/browser/hash-form/trunk/admin/classes/HashFormUploader.php#L135
- https://plugins.trac.wordpress.org/changeset/3161828/
Frequently Asked Questions
What is the severity of CVE-2024-9417?
CVE-2024-9417 is considered a high severity vulnerability due to the potential for unauthenticated file uploads.
How do I fix CVE-2024-9417?
To fix CVE-2024-9417, update the Hash Form Drag & Drop Form Builder plugin to version 1.1.10 or later.
What versions of the Hash Form Drag & Drop Form Builder plugin are affected by CVE-2024-9417?
CVE-2024-9417 affects all versions up to and including 1.1.9 of the Hash Form Drag & Drop Form Builder plugin.
Who can exploit CVE-2024-9417?
CVE-2024-9417 can be exploited by unauthenticated attackers due to improper file type validation.
What types of attacks can CVE-2024-9417 enable?
CVE-2024-9417 can enable attackers to upload arbitrary files, potentially leading to remote code execution.
- agent/title
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- agent/last-modified-date
- agent/remedy
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/hash form
- canonical/hash hash form – drag & drop form builder
- vendor/hashthemes
- canonical/hashthemes hash form