Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: HTB22905: Path disclosure in Wordpress
From: Christian Sciberras <uuf6429 () gmail com>
Date: Wed, 30 Mar 2011 16:39:52 +0200

With regards to the recent bugtrack advisory on WordPress DFA:

Re: HTB22905: Path disclosure in Wordpress

--------------------------------------------------------

Ridiculous! I've been talking about this for some time, the actual
list of vulnerable files follows:

wp-admin\admin-functions.php
wp-admin\includes\admin.php
wp-admin\includes\class-ftp-pure.php
wp-admin\includes\class-ftp-sockets.php
wp-admin\includes\class-wp-filesystem-direct.php
wp-admin\includes\class-wp-filesystem-ftpext.php
wp-admin\includes\class-wp-filesystem-ftpsockets.php
wp-admin\includes\class-wp-filesystem-ssh2.php
wp-admin\includes\comment.php
wp-admin\includes\continents-cities.php
wp-admin\includes\file.php
wp-admin\includes\media.php
wp-admin\includes\misc.php
wp-admin\includes\ms.php
wp-admin\includes\nav-menu.php
wp-admin\includes\plugin-install.php
wp-admin\includes\plugin.php
wp-admin\includes\schema.php
wp-admin\includes\template.php
wp-admin\includes\theme-install.php
wp-admin\includes\update.php
wp-admin\includes\upgrade.php
wp-admin\includes\user.php
wp-admin\maint\repair.php
wp-admin\menu-header.php
wp-admin\menu.php
wp-admin\options-head.php
wp-admin\upgrade-functions.php
wp-config.php
wp-content\themes\twentyten\404.php
wp-content\themes\twentyten\archive.php
wp-content\themes\twentyten\attachment.php
wp-content\themes\twentyten\author.php
wp-content\themes\twentyten\category.php
wp-content\themes\twentyten\comments.php
wp-content\themes\twentyten\footer.php
wp-content\themes\twentyten\functions.php
wp-content\themes\twentyten\header.php
wp-content\themes\twentyten\loop.php
wp-content\themes\twentyten\onecolumn-page.php
wp-content\themes\twentyten\page.php
wp-content\themes\twentyten\search.php
wp-content\themes\twentyten\sidebar-footer.php
wp-content\themes\twentyten\sidebar.php
wp-content\themes\twentyten\single.php
wp-content\themes\twentyten\tag.php
wp-includes\Text\Diff\Engine\native.php
wp-includes\Text\Diff\Engine\string.php
wp-includes\Text\Diff\Engine\xdiff.php
wp-includes\Text\Diff\Renderer\inline.php
wp-includes\Text\Diff\Renderer.php
wp-includes\Text\Diff.php
wp-includes\cache.php
wp-includes\canonical.php
wp-includes\class-feed.php
wp-includes\class-simplepie.php
wp-includes\class-snoopy.php
wp-includes\class.wp-scripts.php
wp-includes\class.wp-styles.php
wp-includes\classes.php
wp-includes\comment-template.php
wp-includes\default-embeds.php
wp-includes\default-filters.php
wp-includes\default-widgets.php
wp-includes\feed-atom-comments.php
wp-includes\feed-atom.php
wp-includes\feed-rdf.php
wp-includes\feed-rss.php
wp-includes\feed-rss2-comments.php
wp-includes\feed-rss2.php
wp-includes\general-template.php
wp-includes\js\tinymce\langs\wp-langs.php
wp-includes\js\tinymce\plugins\spellchecker\classes\EnchantSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\GoogleSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\PSpell.php
wp-includes\js\tinymce\plugins\spellchecker\classes\PSpellShell.php
wp-includes\js\tinymce\plugins\spellchecker\config.php
wp-includes\js\tinymce\wp-mce-help.php
wp-includes\kses.php
wp-includes\l10n.php
wp-includes\media.php
wp-includes\ms-default-constants.php
wp-includes\ms-default-filters.php
wp-includes\ms-functions.php
wp-includes\ms-settings.php
wp-includes\nav-menu-template.php
wp-includes\post.php
wp-includes\query.php
wp-includes\registration-functions.php
wp-includes\rss-functions.php
wp-includes\rss.php
wp-includes\script-loader.php
wp-includes\shortcodes.php
wp-includes\taxonomy.php
wp-includes\template-loader.php
wp-includes\theme-compat\comments-popup.php
wp-includes\theme-compat\comments.php
wp-includes\theme-compat\footer.php
wp-includes\theme-compat\header.php
wp-includes\theme-compat\sidebar.php
wp-includes\theme.php
wp-includes\update.php
wp-includes\user.php
wp-includes\vars.php
wp-includes\widgets.php
wp-includes\wp-db.php
wp-includes\wp-diff.php
wp-settings.php

That's some 30%-40% of all Wordpress files (depending on Wordpress install).

I considered publishing this formally but...

http://codex.wordpress.org/Security_FAQ
See the 5th clause.

If they can't be bothered with proper coding practices, I won't bother
arguing what the meaning behind "optimal security" is either.
For the record, keep in mind that hiding the said errors from output
still doesn't stop them from being logged in the infamous error_log,
which of course can be fixed by (un)setting yet another config.

Seems useless to point out that security is about not shooting at your
own feet as opposed to doing so and mending them later on.

EOR

Chris.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]