Mustlive has found a number of directory traversal vulnerabilities in WP 2.0.11 (Latest 2.0 branch). BlogSec have confirmed this in WordPress 2.3.1. WP 2.3.2 is not vulnerable.

Please note, this only affects WordPress running on MS Windows.

A directory traversal attack, means an attacker can potentially edit and view files outside of its ‘allowed’ area. Depending on how the web server has been configured, this may allow an authenticated user to view sensitive files such as wp-config, password files etc.

The problem lies in the following function:

function validate_file(..)
if (false !== strpos($file, ‘./’))

This works fine for Linux, however, MS Windows operating-systems supports backslash (.\). This means we can bypass the above check (’./’) by using (’.\’).

Proof of concept:
http://site/wp-admin/index.php?page=\..\..\.htaccess

This is fixed in WP 2.3.2 (latest version checks for ‘..’ and ‘./’).