oss-security - Some Wordpress Plugin Stuff

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 5 Sep 2015 06:07:00 -0400
From: Scott Arciszewski <scott@...iszewski.me>
To: oss-security@...ts.openwall.com
Subject: Some Wordpress Plugin Stuff

Hi OSS Sec,

I took a quick glance through some Wordpress plugins tagged with security.
I don't imagine anyone would be surprised that I found vulnerabilities.

-------------------------------

SecurityMoz Security Audit

https://wordpress.org/plugins/securemoz-security-audit/

file_get_contents() + explicitly HTTP (no TLS) -> unserialize()

-------------------------------

WP Limit Login Attempts

https://wordpress.org/plugins/wp-limit-login-attempts/

Trivial SQL injection via HTTP headers.

     $ip = getip();
     $tablename = $wpdb->prefix."limit_login";
     $tablerows = $wpdb->get_results( "SELECT `login_id`,
`login_ip`,`login_attempts`,`attempt_time`,`locked_time` FROM  `$tablename`
  WHERE `login_ip` =  '$ip'  ORDER BY `login_id` DESC LIMIT 1 " );

     // ~8<~8<~8<~8<~8<~8<~8<~8<~

    function getip(){
           if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
            $ip = $_SERVER['HTTP_CLIENT_IP'];
        } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
        } else {
            $ip = $_SERVER['REMOTE_ADDR'];
             if($ip=='::1'){
                 $ip = '127.0.0.1';
             }
        }
        return $ip;
    }

-------------------------------

I'm not sure if it's even worth assigning a CVE to any of these. Maybe the
SQLi one? I leave that decision in MITRE's capable hands.

Also, Tor Blocker (link below) uses HTTP to grab the list of IP addresses
to block. It's telling and appropriate that the person who developed a
plugin to oppose a privacy technology would fail to use TLS.

https://wordpress.org/plugins/tor-exit-nodes-blocker/

(Surely no one would ever think to hack an upstream router and MitM the
connection to block the blog administrator from their own blog or allow Tor
nodes through!)

That's all from me. I might keep poking at some of the fatter plugins to
see what I can find.

Scott Arciszewski

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.