CVE-2019-9618
📋 TL;DR
CVE-2019-9618 is a Local File Inclusion vulnerability in the GraceMedia Media Player WordPress plugin that allows attackers to read arbitrary files on the server via the 'cfg' parameter. This affects WordPress sites running version 1.0 of the plugin. Attackers can potentially access sensitive files like configuration files, password files, or source code.
💻 Affected Systems
- GraceMedia Media Player WordPress Plugin
📦 What is this software?
Gracemedia Media Player by Gracemedia Media Player Project
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through reading sensitive configuration files (like wp-config.php containing database credentials), followed by database access, privilege escalation, or remote code execution.
Likely Case
Information disclosure of sensitive files, potentially leading to credential theft, site defacement, or further exploitation.
If Mitigated
Limited impact with proper file permissions and web server configuration restricting access to sensitive directories.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests to the vulnerable parameter. Multiple public disclosures include proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.1 or later
Vendor Advisory: https://wordpress.org/plugins/gracemedia-media-player/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find 'GraceMedia Media Player'. 4. Click 'Update Now' if available, or delete and install latest version from WordPress repository.
🔧 Temporary Workarounds
Disable or Remove Plugin
allTemporarily disable or completely remove the vulnerable plugin until patched.
wp plugin deactivate gracemedia-media-player
wp plugin delete gracemedia-media-player
Web Application Firewall Rule
linuxBlock requests containing malicious 'cfg' parameter patterns.
ModSecurity rule: SecRule ARGS:cfg "@rx \.\." "id:1001,phase:2,deny,status:403,msg:'CVE-2019-9618 LFI attempt'"
🧯 If You Can't Patch
- Implement strict file permissions (e.g., 644 for files, 755 for directories) and disable directory listing in web server configuration.
- Deploy a web application firewall (WAF) with rules to block Local File Inclusion patterns and monitor for exploitation attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for 'GraceMedia Media Player' version 1.0.Check Version:
wp plugin get gracemedia-media-player --field=versionVerify Fix Applied:
Verify plugin version is 1.1 or later in WordPress admin, or test with controlled LFI payload (e.g., attempt to read /etc/passwd via cfg parameter).📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'cfg' parameter containing path traversal sequences (../, ..\)
- Access to sensitive files like /etc/passwd, wp-config.php from web logs
Network Indicators:
- Unusual GET/POST requests to plugin endpoints with file paths in parameters
SIEM Query:
web_access_logs WHERE url CONTAINS 'cfg' AND (url CONTAINS '../' OR url CONTAINS '..\\' OR url CONTAINS '/etc/' OR url CONTAINS 'wp-config')🔗 References
- http://seclists.org/fulldisclosure/2019/Mar/26
- http://seclists.org/fulldisclosure/2019/Mar/32
- https://wordpress.org/plugins/gracemedia-media-player/#developers
- https://wpvulndb.com/vulnerabilities/9234
- http://seclists.org/fulldisclosure/2019/Mar/26
- http://seclists.org/fulldisclosure/2019/Mar/32
- https://wordpress.org/plugins/gracemedia-media-player/#developers
- https://wpvulndb.com/vulnerabilities/9234
