full-disclosure - Re: WordPress Authenticated File Upload Authorisation Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 21 Jun 2012 08:42:27 -0600
From: Greg Knaddison <greg.knaddison@...uia.com>
To: Denis Andzakovic <denis.andzakovic@...urity-assessment.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: WordPress Authenticated File Upload
 Authorisation Bypass

On Wed, Jun 20, 2012 at 8:04 PM, Denis Andzakovic <
denis.andzakovic@...urity-assessment.com> wrote:

> Exploitation of this vulnerability requires a malicious user with
> access to the admin panel to use the
> "/wp-admin/plugin-install.php?tab=upload" page to upload a malicious
> file.

That tool is meant to allow an admin to upload arbitrary php plugins. You
can argue that this feature is insecure by design, but there are two
solutions from the WordPress perspective:

1) "Don't grant malicious users the permission to install plugins."
2) If you don't want this feature on your site at all, this feature can be
disabled in the config define( 'DISALLOW_FILE_MODS', TRUE);

By the way, two more "vulnerabilities" the theme installer has this same
issue and the upgrade tool could also be abused if you can poison the DNS
of the server.

Regards,
Greg

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/