Rocket Lazy Load Plugin Remote Code Execution (RCE) Vulnerability Overview

Vulnerability Overview The provided webpage screenshot displays the source code for the plugin, specifically the file. This file is part of the Rocket Lazy Load plugin, which implements image lazy loading functionality in WordPress. However, a potential security vulnerability exists within this file that could lead to Remote Code Execution (RCE) or information disclosure. Affected Scope Affected Versions: 2.4.0 and earlier Affected Component: The file within the plugin Potential Risk: Attackers may exploit this vulnerability to execute arbitrary code or obtain sensitive information. Remediation 1. Update Plugin: Users are advised to immediately update the plugin to the latest version to address known security vulnerabilities. 2. Code Review: Conduct a thorough security review of the file to ensure all inputs are properly validated and sanitized. 3. Disable Plugin: If an immediate update is not possible, it is recommended to temporarily disable the plugin until the security issue is resolved. POC Code The following is the POC code block extracted from the screenshot: ```php ]+src="([^"]+)"[^>]>#', $buffer, $images, PREG_SET_ORDER ) ) { return $html; } $images = array_unique( $images, SORT_REGULAR ); foreach ( $images as $image ) { $original_image = $image[0]; $image = $this->canLazyload( $image ); if ( ! $image ) { $image_no_lazy = preg_replace( '/loading="[^"]"/', '', $original_image ); if ( null === $image_no_lazy ) { continue; } $html = str_replace( $original_image, $image_no_lazy, $html ); continue; } $image_lazyload = $this->replaceImage( $image, $use_native ); if ( ! $use_native && $this->noscriptEnabled() ) { $image_lazyload .= $this->noscript( $image[0] ); } $html = str_replace( $image[0], $image_lazyload, $html ); unset( $image_lazyload ); } return $html; } / Applies lazyload on background images defined in style attributes @param string $html Original HTML. @param string $buffer Content to parse. @return string / public function lazyloadBackgroundImages( $html, $buffer ) { if ( ! preg_match_all( '#]+style="[^"]background-image:[^"]url$[^)]$[^"]"[^>]>#', $buffer, $elements, PREG_SET_ORDER ) ) { return $html; } foreach ( $elements as $element ) { if ( $this->isExcluded( $element['before'] . $element['after'] ) ) { $this->getExcludedAttributes(); continue; } / Regex to detect bg images inside CSS. @param string $regex regex to detect. @return string / $regex = apply_filters( 'rocket_lazyload_bg_images_regex', 'background-image:\surl$\s\'?([^"\']+)\'?\s$' ); if ( ! preg_match( '#background-image:[^"]url$\s\'?([^"\']+)\'?\s$#', $element['style'], $url ) ) { continue; } if ( ! preg_match( '#data:image#', $url[1], $img ) ) { continue; } $url[1] = esc_url( wp_strip_all_tags( html_entity_decode( $url[1], ENT_QUOTES ) ) ); if ( $this->isExcluded( $url[1], $this->getExcludedSrc() ) ) { continue; } $slazy_bg = $this->addLazyClass( $element[0] ); $slazy_bg = str_replace( $url[0], '', $slazy_bg ); $slazy_bg = str_replace( 'url(', 'data-bg="', $slazy_bg ); $slazy_bg = str_replace( $url[1], $element['tag'] . ' data-bg="', $slazy_bg ); esc_attr( $url[1] ); $html = str_replace( $element[0], $slazy_bg, $html ); unset( $slazy_bg ); } return $html; } / Add the identifier class to the element @param string $element Element to add the class to. @return string / private function addLazyClass( $element ) { $class = $this->getClasses( $element ); if ( ! $class ) { $result = preg_replace( '#(getQuotedQuotes( $class['classes'] ); $classes = $this->trimQuotes( $class['classes'], $quotes ); if ( empty( $classes ) ) { return str_replace( $class['attribute'], ' class="rocket-lazyload"', $element ); } $classes .= ' rocket-lazyload'; return str_replace( $class['attribute'], ' class="' . $this->normalizeClasses( $classes, $quotes ) . '"', $element ); } / Gets the attribute value's outer quotation mark, if one exists, i.e. " or '. @param string $attribute_value The target attribute's value. @param string $quotes Optional. Quotation mark to wrap around the classes. @return string Quotation character; else false when no quotation mark. / private function getQuotedQuotes( $attribute_value ) { $attribute_value = trim( $attribute_value ); $first_char = $attribute_value[0]; if ( '"' === $first_char return $first_char; } return false; } / Gets the class attribute and values from the given element, if it exists. @param string $element Given HTML element to extract classes from. @return false Type array[string[]] { @type string $attribute Class attribute and value, e.g. class="value" @type string $classes String of class attribute's value(s) } } else, false when no class attribute exists. / private function getClasses( $element ) { if ( ! preg_match( '#class\s=\s("[^"]" return false; } if ( empty( $class['classes'] ) ) { return false; } return [ 'attribute' => $class[0], 'classes' => $class['classes'], ]; } / Removes outer single or double quotations. @param string $string String to strip quotes from. @param false @return string String

Goal Reached Thanks to every supporter — we hit 100%!

Rocket Lazy Load Plugin Remote Code Execution (RCE) Vulnerability Overview

More from this source