How to DoS 29% of the World Wide Websites - CVE-2018-6389

According to wordpress.com, the WordPress platform powers 29% of the worldwide internet websites.

In this article I am going to explain how Denial of Service can easily be caused to almost any WordPress website online, and how you can patch your WordPress website in order to avoid this vulnerability being exploited.

It is important to note that exploiting this vulnerability is illegal, unless you have permission from the website owner.

While browsing a WordPress website, my attention was drawn to the following URL:

https://WPServer/wp-admin/load-scripts.php?c=1&load%5B%5D=jquery-ui-core&ver=4.9.1

The load-scripts.php file receives a parameter called load[], the parameter value is 'jquery-ui-core'. In the response, I received the JS module 'jQuery UI Core' that was requested, as demonstrated in the following image:

Gem in a box CSRF file upload - CVE-2017-14506

In this blog post I will give a short example of exploiting CSRF vulnerability on Geminabox.
So Geminabox is an application allows you manage your internal gems was vulnerable to CSRF on upload file.
In order to exploit the CSRF vulnerability I wrote really small tool called csrFile, which allows you to generate HTML that uploads any type of file to the supplied endpoint, you can check it out in the following link:
https://github.com/Quitten/csrFile
Usage: python csrFile.py <url> <filePath>

So using the following command, you can easily create an HTML document that exploits the CSRF attack and uploads malicious gem file to the targeted server:
python csrFile.py https://geminaboxserve/upload xss.gem

Then in case the victim will browse to the attacker's link that contains the HTML generated from csrFile, his browser will automatically will upload the attacker's malicious gem to geminabox system.
Note: it is possible to exploit persistent XSS attack (CVE-2017-14506) in that way as well.