Re: Re: HTB22905: Path disclosure in Wordpress

[mike]

I agree,  this is a configuration issue not an issue with Wordpress.   
Wordpress SHOULD NOT fix this issue because it will make it more difficult to 
write wordpress modules. 

All production systems should have this configuration:
display_errors=off

Re: HTB22905: Path disclosure in Wordpress

[Christian Sciberras]

Ridiculous! I've been talking about this for some time, the actual
list of vulnerable files follows:

wp-admin\admin-functions.php
wp-admin\includes\admin.php
wp-admin\includes\class-ftp-pure.php
wp-admin\includes\class-ftp-sockets.php
wp-admin\includes\class-wp-filesystem-direct.php
wp-admin\includes\class-wp-filesystem-ftpext.php
wp-admin\includes\class-wp-filesystem-ftpsockets.php
wp-admin\includes\class-wp-filesystem-ssh2.php
wp-admin\includes\comment.php
wp-admin\includes\continents-cities.php
wp-admin\includes\file.php
wp-admin\includes\media.php
wp-admin\includes\misc.php
wp-admin\includes\ms.php
wp-admin\includes\nav-menu.php
wp-admin\includes\plugin-install.php
wp-admin\includes\plugin.php
wp-admin\includes\schema.php
wp-admin\includes\template.php
wp-admin\includes\theme-install.php
wp-admin\includes\update.php
wp-admin\includes\upgrade.php
wp-admin\includes\user.php
wp-admin\maint\repair.php
wp-admin\menu-header.php
wp-admin\menu.php
wp-admin\options-head.php
wp-admin\upgrade-functions.php
wp-config.php
wp-content\themes\twentyten\404.php
wp-content\themes\twentyten\archive.php
wp-content\themes\twentyten\attachment.php
wp-content\themes\twentyten\author.php
wp-content\themes\twentyten\category.php
wp-content\themes\twentyten\comments.php
wp-content\themes\twentyten\footer.php
wp-content\themes\twentyten\functions.php
wp-content\themes\twentyten\header.php
wp-content\themes\twentyten\loop.php
wp-content\themes\twentyten\onecolumn-page.php
wp-content\themes\twentyten\page.php
wp-content\themes\twentyten\search.php
wp-content\themes\twentyten\sidebar-footer.php
wp-content\themes\twentyten\sidebar.php
wp-content\themes\twentyten\single.php
wp-content\themes\twentyten\tag.php
wp-includes\Text\Diff\Engine\native.php
wp-includes\Text\Diff\Engine\string.php
wp-includes\Text\Diff\Engine\xdiff.php
wp-includes\Text\Diff\Renderer\inline.php
wp-includes\Text\Diff\Renderer.php
wp-includes\Text\Diff.php
wp-includes\cache.php
wp-includes\canonical.php
wp-includes\class-feed.php
wp-includes\class-simplepie.php
wp-includes\class-snoopy.php
wp-includes\class.wp-scripts.php
wp-includes\class.wp-styles.php
wp-includes\classes.php
wp-includes\comment-template.php
wp-includes\default-embeds.php
wp-includes\default-filters.php
wp-includes\default-widgets.php
wp-includes\feed-atom-comments.php
wp-includes\feed-atom.php
wp-includes\feed-rdf.php
wp-includes\feed-rss.php
wp-includes\feed-rss2-comments.php
wp-includes\feed-rss2.php
wp-includes\general-template.php
wp-includes\js\tinymce\langs\wp-langs.php
wp-includes\js\tinymce\plugins\spellchecker\classes\EnchantSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\GoogleSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\PSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\PSpellShell.php
wp-includes\js\tinymce\plugins\spellchecker\config.php
wp-includes\js\tinymce\wp-mce-help.php
wp-includes\kses.php
wp-includes\l10n.php
wp-includes\media.php
wp-includes\ms-default-constants.php
wp-includes\ms-default-filters.php
wp-includes\ms-functions.php
wp-includes\ms-settings.php
wp-includes\nav-menu-template.php
wp-includes\post.php
wp-includes\query.php
wp-includes\registration-functions.php
wp-includes\rss-functions.php
wp-includes\rss.php
wp-includes\script-loader.php
wp-includes\shortcodes.php
wp-includes\taxonomy.php
wp-includes\template-loader.php
wp-includes\theme-compat\comments-popup.php
wp-includes\theme-compat\comments.php
wp-includes\theme-compat\footer.php
wp-includes\theme-compat\header.php
wp-includes\theme-compat\sidebar.php
wp-includes\theme.php
wp-includes\update.php
wp-includes\user.php
wp-includes\vars.php
wp-includes\widgets.php
wp-includes\wp-db.php
wp-includes\wp-diff.php
wp-settings.php

That's some 30%-40% of all Wordpress files (depending on Wordpress install).

I considered making this public but...

http://codex.wordpress.org/Security_FAQ

Read the 5th clause.


Chris.





On Tue, Mar 29, 2011 at 11:55 AM, advis...@htbridge.ch wrote:

 Vulnerability ID: HTB22905
 Reference: http://www.htbridge.ch/advisory/path_disclosure_in_wordpress.html
 Product: Wordpress
 Vendor: http://wordpress.org/ ( http://wordpress.org/ )
 Vulnerable Version: 3.1
 Vendor Notification: 15 March 2011
 Vulnerability Type: Path disclosure
 Status: Not Fixed
 Risk level: Low
 Credit: High-Tech Bridge SA - Ethical Hacking  Penetration Testing 
 (http://www.htbridge.ch/)

 Vulnerability Details:
 The vulnerability exists due to failure in the /wp-includes/theme-compat/  
 /wp-content/themes/twentyten/ scripts, it's possible to generate an error 
 that will reveal the full path of the script.
 A remote user can determine the full path to the web root directory and other 
 potentially sensitive information.

 The following PoC is available:

 [code]
 /wp-includes/theme-compat/comments-popup.php
 /wp-includes/theme-compat/comments.php
 /wp-includes/theme-compat/footer.php
 /wp-includes/theme-compat/sidebar.php
 /wp-content/themes/twentyten/index.php
 

Re: HTB22905: Path disclosure in Wordpress

[Patrick Kelley]

Seems like most of the vulnerabilities from the last couple days are
not actual software issues, but problems with configuration of the
server or just not following the directions provided by the vendor.

If that is our measure for vulnerability, I can show about 10 for the
wristwatch I am wearing...

On Tue, Mar 29, 2011 at 11:42 AM, Christian Sciberras uuf6...@gmail.com wrote:
 Ridiculous! I've been talking about this for some time, the actual
 list of vulnerable files follows:

 wp-admin\admin-functions.php
 wp-admin\includes\admin.php
 wp-admin\includes\class-ftp-pure.php
 wp-admin\includes\class-ftp-sockets.php
 wp-admin\includes\class-wp-filesystem-direct.php
 wp-admin\includes\class-wp-filesystem-ftpext.php
 wp-admin\includes\class-wp-filesystem-ftpsockets.php
 wp-admin\includes\class-wp-filesystem-ssh2.php
 wp-admin\includes\comment.php
 wp-admin\includes\continents-cities.php
 wp-admin\includes\file.php
 wp-admin\includes\media.php
 wp-admin\includes\misc.php
 wp-admin\includes\ms.php
 wp-admin\includes\nav-menu.php
 wp-admin\includes\plugin-install.php
 wp-admin\includes\plugin.php
 wp-admin\includes\schema.php
 wp-admin\includes\template.php
 wp-admin\includes\theme-install.php
 wp-admin\includes\update.php
 wp-admin\includes\upgrade.php
 wp-admin\includes\user.php
 wp-admin\maint\repair.php
 wp-admin\menu-header.php
 wp-admin\menu.php
 wp-admin\options-head.php
 wp-admin\upgrade-functions.php
 wp-config.php
 wp-content\themes\twentyten\404.php
 wp-content\themes\twentyten\archive.php
 wp-content\themes\twentyten\attachment.php
 wp-content\themes\twentyten\author.php
 wp-content\themes\twentyten\category.php
 wp-content\themes\twentyten\comments.php
 wp-content\themes\twentyten\footer.php
 wp-content\themes\twentyten\functions.php
 wp-content\themes\twentyten\header.php
 wp-content\themes\twentyten\loop.php
 wp-content\themes\twentyten\onecolumn-page.php
 wp-content\themes\twentyten\page.php
 wp-content\themes\twentyten\search.php
 wp-content\themes\twentyten\sidebar-footer.php
 wp-content\themes\twentyten\sidebar.php
 wp-content\themes\twentyten\single.php
 wp-content\themes\twentyten\tag.php
 wp-includes\Text\Diff\Engine\native.php
 wp-includes\Text\Diff\Engine\string.php
 wp-includes\Text\Diff\Engine\xdiff.php
 wp-includes\Text\Diff\Renderer\inline.php
 wp-includes\Text\Diff\Renderer.php
 wp-includes\Text\Diff.php
 wp-includes\cache.php
 wp-includes\canonical.php
 wp-includes\class-feed.php
 wp-includes\class-simplepie.php
 wp-includes\class-snoopy.php
 wp-includes\class.wp-scripts.php
 wp-includes\class.wp-styles.php
 wp-includes\classes.php
 wp-includes\comment-template.php
 wp-includes\default-embeds.php
 wp-includes\default-filters.php
 wp-includes\default-widgets.php
 wp-includes\feed-atom-comments.php
 wp-includes\feed-atom.php
 wp-includes\feed-rdf.php
 wp-includes\feed-rss.php
 wp-includes\feed-rss2-comments.php
 wp-includes\feed-rss2.php
 wp-includes\general-template.php
 wp-includes\js\tinymce\langs\wp-langs.php
 wp-includes\js\tinymce\plugins\spellchecker\classes\EnchantSpell.php
 wp-includes\js\tinymce\plugins\spellchecker\classes\GoogleSpell.php
 wp-includes\js\tinymce\plugins\spellchecker\classes\PSpell.php
 wp-includes\js\tinymce\plugins\spellchecker\classes\PSpellShell.php
 wp-includes\js\tinymce\plugins\spellchecker\config.php
 wp-includes\js\tinymce\wp-mce-help.php
 wp-includes\kses.php
 wp-includes\l10n.php
 wp-includes\media.php
 wp-includes\ms-default-constants.php
 wp-includes\ms-default-filters.php
 wp-includes\ms-functions.php
 wp-includes\ms-settings.php
 wp-includes\nav-menu-template.php
 wp-includes\post.php
 wp-includes\query.php
 wp-includes\registration-functions.php
 wp-includes\rss-functions.php
 wp-includes\rss.php
 wp-includes\script-loader.php
 wp-includes\shortcodes.php
 wp-includes\taxonomy.php
 wp-includes\template-loader.php
 wp-includes\theme-compat\comments-popup.php
 wp-includes\theme-compat\comments.php
 wp-includes\theme-compat\footer.php
 wp-includes\theme-compat\header.php
 wp-includes\theme-compat\sidebar.php
 wp-includes\theme.php
 wp-includes\update.php
 wp-includes\user.php
 wp-includes\vars.php
 wp-includes\widgets.php
 wp-includes\wp-db.php
 wp-includes\wp-diff.php
 wp-settings.php

 That's some 30%-40% of all Wordpress files (depending on Wordpress install).

 I considered making this public but...

 http://codex.wordpress.org/Security_FAQ

 Read the 5th clause.


 Chris.





 On Tue, Mar 29, 2011 at 11:55 AM, advis...@htbridge.ch wrote:

 Vulnerability ID: HTB22905
 Reference: http://www.htbridge.ch/advisory/path_disclosure_in_wordpress.html
 Product: Wordpress
 Vendor: http://wordpress.org/ ( http://wordpress.org/ )
 Vulnerable Version: 3.1
 Vendor Notification: 15 March 2011
 Vulnerability Type: Path disclosure
 Status: Not Fixed
 Risk level: Low
 Credit: High-Tech Bridge SA - Ethical Hacking  Penetration Testing 
 (http://www.htbridge.ch/)

 Vulnerability Details:
 The vulnerability exists due to failure in the 

Re: HTB22905: Path disclosure in Wordpress

[Patrick Kelley]

My point-of-view is that anything can be made insecure.  The
WordPress issue is avoidable by just configuring the server to common
standards of not displaying errors in a production environment.  That
seems pretty simple.  I can see instances where I would want the
software to reveal the path if needed to troubleshoot a WP instance.
That can be done in a controlled test environment by allowing errors
to be displayed through PHP.

Removing functionality to get around configuring the environment
properly seems counterproductive.

The Simple PHP Newsletter vulnerabilities from yesterday are a
highlight of the same thing.  Follow the instructions and remove the
install directory.  This is not an exploit or vulnerability in the
software, either.  Those directories are required to be there to
install and upon finishing installation, you remove them.  Problem
solved.

The Ubuntu releases in the last couple of days are actual software
issues in my opinion, not just poorly configured environments.

On Wed, Mar 30, 2011 at 11:32 AM, Christian Sciberras uuf6...@gmail.com wrote:
 I disagree. It is definitely a software issue.

 I just can't waste time with this, so I'll highlight a quick example;
 Firefox (as a clear example) comes with the right security dialogs
 enabled, even if you can later on tell it to always open exe files
 after download.

 The same can't be said for Wordpress, where it comes vulnerable by
 default. By the same reasoning, why does Wordpress ask for a user
 password during install? Why not a default one (and then tell people
 to change it in the manual)?


 Keep in mind I'm not viewing this from a pure security perspective;
 I'm foremost a software developer, not security specialist, and I see
 it good practice to build on solid practices.

 As to the watch analogy, I'm not sure I get it.


 Regards,
 Chris.




 On Wed, Mar 30, 2011 at 5:22 PM, Patrick Kelley psw...@gmail.com wrote:
 Seems like most of the vulnerabilities from the last couple days are
 not actual software issues, but problems with configuration of the
 server or just not following the directions provided by the vendor.

 If that is our measure for vulnerability, I can show about 10 for the
 wristwatch I am wearing...

 On Tue, Mar 29, 2011 at 11:42 AM, Christian Sciberras uuf6...@gmail.com 
 wrote:
 Ridiculous! I've been talking about this for some time, the actual
 list of vulnerable files follows:

 wp-admin\admin-functions.php
 wp-admin\includes\admin.php
 wp-admin\includes\class-ftp-pure.php
 wp-admin\includes\class-ftp-sockets.php
 wp-admin\includes\class-wp-filesystem-direct.php
 wp-admin\includes\class-wp-filesystem-ftpext.php
 wp-admin\includes\class-wp-filesystem-ftpsockets.php
 wp-admin\includes\class-wp-filesystem-ssh2.php
 wp-admin\includes\comment.php
 wp-admin\includes\continents-cities.php
 wp-admin\includes\file.php
 wp-admin\includes\media.php
 wp-admin\includes\misc.php
 wp-admin\includes\ms.php
 wp-admin\includes\nav-menu.php
 wp-admin\includes\plugin-install.php
 wp-admin\includes\plugin.php
 wp-admin\includes\schema.php
 wp-admin\includes\template.php
 wp-admin\includes\theme-install.php
 wp-admin\includes\update.php
 wp-admin\includes\upgrade.php
 wp-admin\includes\user.php
 wp-admin\maint\repair.php
 wp-admin\menu-header.php
 wp-admin\menu.php
 wp-admin\options-head.php
 wp-admin\upgrade-functions.php
 wp-config.php
 wp-content\themes\twentyten\404.php
 wp-content\themes\twentyten\archive.php
 wp-content\themes\twentyten\attachment.php
 wp-content\themes\twentyten\author.php
 wp-content\themes\twentyten\category.php
 wp-content\themes\twentyten\comments.php
 wp-content\themes\twentyten\footer.php
 wp-content\themes\twentyten\functions.php
 wp-content\themes\twentyten\header.php
 wp-content\themes\twentyten\loop.php
 wp-content\themes\twentyten\onecolumn-page.php
 wp-content\themes\twentyten\page.php
 wp-content\themes\twentyten\search.php
 wp-content\themes\twentyten\sidebar-footer.php
 wp-content\themes\twentyten\sidebar.php
 wp-content\themes\twentyten\single.php
 wp-content\themes\twentyten\tag.php
 wp-includes\Text\Diff\Engine\native.php
 wp-includes\Text\Diff\Engine\string.php
 wp-includes\Text\Diff\Engine\xdiff.php
 wp-includes\Text\Diff\Renderer\inline.php
 wp-includes\Text\Diff\Renderer.php
 wp-includes\Text\Diff.php
 wp-includes\cache.php
 wp-includes\canonical.php
 wp-includes\class-feed.php
 wp-includes\class-simplepie.php
 wp-includes\class-snoopy.php
 wp-includes\class.wp-scripts.php
 wp-includes\class.wp-styles.php
 wp-includes\classes.php
 wp-includes\comment-template.php
 wp-includes\default-embeds.php
 wp-includes\default-filters.php
 wp-includes\default-widgets.php
 wp-includes\feed-atom-comments.php
 wp-includes\feed-atom.php
 wp-includes\feed-rdf.php
 wp-includes\feed-rss.php
 wp-includes\feed-rss2-comments.php
 wp-includes\feed-rss2.php
 wp-includes\general-template.php
 wp-includes\js\tinymce\langs\wp-langs.php
 wp-includes\js\tinymce\plugins\spellchecker\classes\EnchantSpell.php
 

HTB22905: Path disclosure in Wordpress

[advisory]

Vulnerability ID: HTB22905
Reference: http://www.htbridge.ch/advisory/path_disclosure_in_wordpress.html
Product: Wordpress
Vendor: http://wordpress.org/ ( http://wordpress.org/ ) 
Vulnerable Version: 3.1
Vendor Notification: 15 March 2011 
Vulnerability Type: Path disclosure
Status: Not Fixed
Risk level: Low 
Credit: High-Tech Bridge SA - Ethical Hacking  Penetration Testing 
(http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the /wp-includes/theme-compat/  
/wp-content/themes/twentyten/ scripts, it's possible to generate an error 
that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other 
potentially sensitive information.

The following PoC is available:

[code]
/wp-includes/theme-compat/comments-popup.php
/wp-includes/theme-compat/comments.php
/wp-includes/theme-compat/footer.php
/wp-includes/theme-compat/sidebar.php
/wp-content/themes/twentyten/index.php
/wp-content/themes/twentyten/404.php
/wp-content/themes/twentyten/archive.php
[/code]