full-disclosure - [FD] Wordpress iThemes Security (Better WP Security) Insecure Backup/Logfile Generation (access rights)

Open Source and information security mailing list archives

Message-ID: <57188B65.4080501@sysdream.com>
Date: Thu, 21 Apr 2016 09:12:21 +0100
From: Sysdream Labs <labs@...dream.com>
To: oss-security@...ts.openwall.com, fulldisclosure@...lists.org
Subject: [FD] Wordpress iThemes Security (Better WP Security) Insecure
 Backup/Logfile Generation (access rights)

Wordpress iThemes Security (Better WP Security) Insecure Backup/Logfile Generation (access rights)
==================================================================================================

Description
===========

A vulnerability has been found in iThemes Security backup function that may allow attackers to gain access to backup/log files.

By default, when using the "database backup on filesystem" feature, iThemes Security saves the backup files in a world-readable directory :

wp-content/uploads/ithemes-security/backups

The .htaccess file is generated during the plugin initial setup/update, only if the wp-content/uploads/ithemes-security/backups exists (or wp-content/uploads/ithemes-security/logs). Note that it does *NOT* exists by default.

When running a backup, the ITSEC_Backup class creates the directory but *without* any .htaccess file inside.
The same thing happens with log saving.

If the webserver has directory listing enabled, then anybody can download the complete database backup or view the log files.

**Access Vector**: remote

**Security Risk**: high

**Vulnerability**: CWE-219

**CVSS Base Score**: 7.5

---------------
Vulnerable code
---------------

The vulnerable code is located in core/modules/backup/class-itsec-backup.php, line 246 :

    if ( ! is_dir( $itsec_globals['ithemes_backup_dir'] ) ) {
        @mkdir( trailingslashit( $itsec_globals['ithemes_dir'] ) . 'backups' );
    }

And in core/class-itsec-logger.php, line 31 :

    //Make sure the logs directory was created
    if ( ! is_dir( $itsec_globals['ithemes_log_dir'] ) ) {
            @mkdir( trailingslashit( $itsec_globals['ithemes_dir'] ) . 'logs' );
    }

The application creates the backup/log directory, but *not* the .htaccess/index file inside.

--------
Solution
--------

Add a default index file file inside the backup folder when creating the directory or store the backups outside of the web root.

Update iThemes Security to version >= 5.3.1

Timeline (dd/mm/yyyy)
=====================

* 26/02/2016 : Initial contact with iThemes.
* 26/02/2016 : iThemes confirms the vulnerabilities.
* 29/02/2016 : iThemes publishes a new version (5.3.1) of iThemes Security that fixes the vulnerabilities.

Credits
=======

* Nicolas CHATELAIN, Sysdream (n.chatelain -at- sysdream -dot- com)

-- 
SYSDREAM Labs <labs@...dream.com>

GPG :
47D1 E124 C43E F992 2A2E
1551 8EB4 8CD9 D5B2 59A1

* Website: https://sysdream.com/
* Twitter: @sysdream

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives