Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 5 Sep 2015 06:07:00 -0400
From: Scott Arciszewski <scott@...iszewski.me>
To: oss-security@...ts.openwall.com
Subject: Some Wordpress Plugin Stuff

Hi OSS Sec,

I took a quick glance through some Wordpress plugins tagged with security.
I don't imagine anyone would be surprised that I found vulnerabilities.

-------------------------------

SecurityMoz Security Audit

https://wordpress.org/plugins/securemoz-security-audit/

file_get_contents() + explicitly HTTP (no TLS) -> unserialize()

-------------------------------

WP Limit Login Attempts

https://wordpress.org/plugins/wp-limit-login-attempts/

Trivial SQL injection via HTTP headers.

     $ip = getip();
     $tablename = $wpdb->prefix."limit_login";
     $tablerows = $wpdb->get_results( "SELECT `login_id`,
`login_ip`,`login_attempts`,`attempt_time`,`locked_time` FROM  `$tablename`
  WHERE `login_ip` =  '$ip'  ORDER BY `login_id` DESC LIMIT 1 " );

     // ~8<~8<~8<~8<~8<~8<~8<~8<~

    function getip(){
           if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
            $ip = $_SERVER['HTTP_CLIENT_IP'];
        } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
        } else {
            $ip = $_SERVER['REMOTE_ADDR'];
             if($ip=='::1'){
                 $ip = '127.0.0.1';
             }
        }
        return $ip;
    }

-------------------------------

I'm not sure if it's even worth assigning a CVE to any of these. Maybe the
SQLi one? I leave that decision in MITRE's capable hands.

Also, Tor Blocker (link below) uses HTTP to grab the list of IP addresses
to block. It's telling and appropriate that the person who developed a
plugin to oppose a privacy technology would fail to use TLS.

https://wordpress.org/plugins/tor-exit-nodes-blocker/

(Surely no one would ever think to hack an upstream router and MitM the
connection to block the blog administrator from their own blog or allow Tor
nodes through!)

That's all from me. I might keep poking at some of the fatter plugins to
see what I can find.

Scott Arciszewski

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ