full-disclosure - Re: Denial of Service in WordPress

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130628055652.GD9811@debjann.fritz.box>
Date: Fri, 28 Jun 2013 07:56:52 +0200
From: Jann Horn <jann@...jh.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Denial of Service in WordPress

On Thu, Jun 27, 2013 at 11:50:47PM +0300, MustLive wrote:
> > This just affects the client though right? 
> 
> This DoS only going on client side unlike other types of DoS (see my classification), but issue of web application is in allowing Looped DoS state. You see error message very quickly because you are leaving in 2013 (where already many browsers protect against simple form of Looped DoS) and using secure browser - use a browser without this protection (like IE) and have fun.

Sooo... a bunch of browsers doing one request at a time (instead of doing a real attack) and which slow down if your server becomes unresponsive is a threat? Seriously, that might become a few hundred requests per second or so if a largeish amount of clients participates, but that shouldn't be able to bring down your server.

> > From my understanding you'd have to get the user to click on the tinyurl
> 
> How the attack must go to benefit the attacker. One way is to give people (with vulnerable browsers) to click the link and see endless loop - it'll not give enough overload on target server, since people will quickly close the browser's tab/window. Another one is to give that link to crazy bots (like from search engines), who has no limits on redirects - it'll endlessly connect to target site/sites and overload them.

You said it – you'd need "crazy bots" for that. crazy bots with an absurd amount of bandwidth (since they're probably not just indexing your site). I think you'll have a hard time finding those – as far as I know, it's standard practice to put at least one second of delay between two requests, and that rate shouldn't be harmful at all.

> Even better way is to put iframe which leads to such redirector at some sites (the more the better) - it can be ad network with such "fun banner" or hacked web sites with added iframe or via persistent XSS hole. While people will be at such sites the browser in background will be infinitely sending requests to target site/sites (in case of WP redirectors it will be two sites for the first attack with using of tinyurl.com and one site in case of the second attack, which works in all WordPress, including WP 3.5.2). The more time people spend on particular page with injected iframe with endless redirect and the more people are visiting such sites, the more effect will be. No need to ask people to "participate in DoS attack", their browser will be automatically "participating" via Looped DoS attack (just by entering in any way this endless loop).

Yeah, that could happen... but why only do one request at a time? Just use a javascript that reloads 100 images with src=<targetsite> at a time, and you have your attack completely without using any vulns (and some scriptkiddies actually did that, see <http://loic.webs.com/>). Tip: If you can do something without using a vuln or so, having a vuln for it is worthless.

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/