Tag: security

Sorry I didn’t do a report for last week. I had the honor of speaking at WordCamp Miami last week so was a bit busy.  Speaking of which, if you weren’t there, or were but was at one of the other excellent presentations, they’ve now posted the recorded version (I start at roughly 0:33:00).  In addition, my talk from WordCamp St. Louis is now posted over at WordPress.tv.  And if you prefer to see it live, I’ll be presenting it again at WordCamp Kansas City on April 29th.

This week’s vulnerable plugins report.

You should have already noticed that WordPress released version 4.7.3 update on Monday.  4.7.3 addresses six security vulnerabilities (one of which was discovered by my buddy Delta!) in addition to 39 bug fixes.  Equally important is that security patches were issued for all WordPress branches back to version 3.7.  If you are running any version of WordPress from 3.7 forward you should update immediately as there are now attacks in the wild targeting the vulnerabilities that were corrected.

If you are on an older version, please strongly consider upgrading to a more current branch. While I applaud the WordPress team for patching all branches back to 3.7, you can’t rely on them supporting those older branches moving forward.   Staying up-to-date is one of the most important ways to protect your site.  The WordPress development team has done an amazing job of ensuring backwards compatibility, so unless you have made changes to the core WordPress files, there is a strong chance you can update to the latest version without incident.  If you’re unsure of updating, please reach out to me and let’s see if we can get you updated.

I had hoped this week’s report would be quieter, but instead includes five unauthenticated arbitrary file upload disclosures.  PLEASE, remove or update these plugins immediately.

This week’s report.

This week’s report is pretty large, due in large part to the disclosure of the remaining discoveries from last year’s sumofpwn that were never fixed, despite repeated attempts to contact/work with the developers.

There are a couple of items in the report I want to address directly.  They are listed in the notes section but I want to highlight them. In looking at the svn repository for Adminer, they fixed the issue in v1.4.5, but the plugin has been removed from the public repository. In general, having a world-accessible direct connection to your database is a bad idea. I would suggest going ahead and removing the plugin if you have it installed. You can read more about the initial disclosure.

The disclosure for FormBuilder was for version was 1.0.5 with the latest version being 1.0.8. Though the initial disclosure doesn’t mention it, the plugin does output the contents of user supplied data in other areas (and continues to do so in the most recent version). In addition, the plugin’s description mentions that the plugin is reaching end of life.

Be advised, FormBuilder is nearing end-of-life and may not be actively maintained in the future. It is advisable to switch your WordPress site to some other Form handling plugin at this time.

Given it continues to have potential issues and it’s reaching end-of-life, I would strongly suggest removing.

In regards to the Trust Form plugin, there is a version in the svn repository (2.0.1) where it appears the author tried to address some of the disclosed vulnerabilities. However, there are other areas that are still vulnerable to cross-site scripting, which is most likely why the plugin has been removed from the public repository. I would strongly suggest removing the plugin.

This week’s report.

TL;DR – If you use cloudflare you need to invalidate all sessions for the site and update passwords for accounts immediately.

From TechCrunch:

Cloudflare revealed a serious bug in its software today that caused sensitive data like passwords, cookies, authentication tokens to spill in plaintext from its customers’ websites.

And from the initial disclosure:

if an html page hosted behind cloudflare had a specific combination of unbalanced tags, the proxy would intersperse pages of uninitialized memory into the output

Worse yet, some of that disclosed information was cached by search engines.  If you are using WordPress, and are using Cloudflare, you should change the salts in your wp-list.php file and update your passwords.   If you can’t have every registered user of your site update their passwords, then at a minimum, update all of the passwords for your administrator accounts.

For other sites that are using Cloudflare, you need to invalidate all sessions and have users update their passwords.

In WordPress specific news, the 4.7.3 update has been scheduled for release Monday, March 6^th.  If you don’t have auto-updates enabled, make sure you plan to update your site.  As far as I know, this update mostly addresses bug fixes, but I haven’t had a chance to look over the full set of changes. 

And finally, this week’s vulnerable plugins/themes report. 

I do these updates and vulnerable plugin reports for the University of Missouri campus and thought I’d include them here as well.

Everyone should be updated to WordPress version 4.7 by now.  If not, please do so as soon as you can.  Lots of new, exciting features were added: WordPress 4.7 announcement and changelog.

If you didn’t follow Matt Mullenweg’s State of the Word this year from WordCamp US, you can watch it online (jump to 1:22:27  to see me question Matt on WordPress security issues).  If you’re interested, I also wrote up my key take-aways from WordCamp: Part 1 and Part 2. 

One of the big announcements from Matt was that he is taking back over as product lead for 2017 and that there will be no scheduled releases for WordPress in 2017.  Instead, the core team will be focusing on a simpler, faster UX (specifically the post editor) and more power for developers.  Minor point releases for bugs and security issues will be released as necessary, but large point releases will not be on a schedule. 

One of the big announcements for v4.7 was the core team added multiple content endpoints for the new REST API.  Unfortunately, one of those endpoints is users.   This means that anyone can remotely query your site for a list of your users.  Despite all of our efforts to lock down this sensitive information leakage, WordPress has added yet another way to retrieve this information.  To disable this “feature”, add the code from this gist into your functions.php file in your theme.  

You also might have heard quite a bit recently about the remote code execution vulnerability inside of PHPMailer which is included in WordPress core. While it is a critical vulnerability, several pieces have to align correctly in order for it to be exploited inside of WordPress.  An attacker would either need to combine multiple successful attacks, or already have an admin account on the site.  And if they have an admin account already, you’re already in trouble.  I mention it because WordPress will be updating their version in the coming days so make sure to update as soon as it is released.  More importantly, I would begin looking through your theme and plugins to see if they have included the vulnerable version.  If so, I would suggest manually updating the PHPMailer version, or discontinue use of the theme/plugin until that file has been updated.

Last, but not least, the vulnerable plugins report for 20170104:

https://docs.google.com/spreadsheets/d/1It-bOSM3AR_PVjKINvCe0bhiePEgT6L1EC4Sq3UxBIQ/edit?usp=sharing