Code Execution vulnerability in WordPress

[macbroadcast]

An attacker was able to upload a “directory”within the wordpress directory and i found out that the “contact form”module might cause the problem because i allways found a “wpcf7_captcha”directory in my upload folder ,so i removed the module ,set new passwords for worpress and all went fine for a day.

Today i received another mail from rsa.com that the same script is still on my site just in a “theme”folder.

​http://let.de/wp-content/themes/twentyten/www1.royalbank.com/index.html

It seems the attacker found a vulnerabilty in wordpress so i removed the used theme and directory.

SecurityVulns ID:11622.

Affected products:

Vulnerable are versions WordPress 2.5 –3.1.1. The new version 3.1.2 which released at 26th of April just after my disclosure also must be vulnerable. The attack via double extension will work at Apache with appropriate configuration.

———- Details:———-

Code Execution (WASC-31) attack is possible in WordPress via uploader. The attack can be conducted by users with roles Author,Editor and Administrator. In WordPress 2.5 –2.8.4 it’s possible to upload php scripts (1.php) in Media Library. In 2.5 –2.7.1 the attack is possible only for Administrator. For Author and Editor it’s not possible to upload 1.php,nor attack will work via double extensions. In version 2.8.5 it was prohibited also for Administrator. And even in 2.8 –2.8.5 for Author and Editor (and for Administrator in 2.8.5) it’s impossible to upload 1.php,but it’s possible to upload 1.php.txt. At that in WP 2.0 –2.0.11 (where there were no Media Library) for all roles were prohibited to upload files with php extension (and bypassing method didn’t work). As in versions 2.1.x,2.2.x and 2.3.x. Only in WordPress 2.2 (​http://websecurity.com.ua/1276/) Alexander Concha found vulnerability,which allowed to upload files with php extension. In version 2.8.6 and higher it’s already prohibited. The attack via double extensions (1.php.txt and 1.asp;.txt) will not work,but it’s possible to use 1.phtml.txt (for all three roles) to execute code.

————Timeline:————

2011.04.26 –disclosed at my site. As I already wrote many times to security mailing lists (​http://www.securityfocus.com/archive/1/510274),starting from 2008 I never more inform WP developers about vulnerabilities in WordPress. I mentioned about these vulnerabilities at my site (​http://websecurity.com.ua/5108/). Best wishes ®ards,MustLive Administrator of Websecurity web site ​http://websecurity.com.ua

more at

​http://let.de/index.php/code-execution-vulnerability-in-wordpress/

[macbroadcast]

this is the philising script whitch were uploadet to my wp instaltion

[ocean90]

From the big red box:

Do not report potential security vulnerabilities here. Read the ​Security FAQ and email us at security@….

[macbroadcast]

i wrote to the email adress you mentioned and i am waiting for a response.

regards

[nacin]

Replying to macbroadcast:

i wrote to the email adress you mentioned and i am waiting for a response.

Next time do that first. Two years ago.

This ticket is invalid as of 3.1.3.

[macbroadcast]

I did this first,( July 3, 2011 2:45:52 PM GMT+02:00)but they simple dont respond and whatever is invalid or not, ive got attacked several times since friday and i am using the latest wordpress version 3.1.4. i changed my worpress password and its still possible to compromise the system.So tell me whats invalid now

[nacin]

You emailed us 2.5 hours ago on a Sunday morning.

You also emailed a mailing list *before* you emailed security@…, and then didn't wait for a reply before posting here.

I don't think you being hacked has anything to do with an ongoing attack vector. You're welcome to email access logs to security@… to back up your claim.

In the meantime, I want to emphasize yet another reason why we encourage responsible disclosure versus full disclosure -- the reporter isn't always right.

[xknown]

It would be good to fix the security FAQ link when creating a new ticket (see #17479) :)

macbroadcast, the attack vector you mention can only be used with in a multi user environment, which does not seem to be the case for your site.