Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: TWSL2012-002: Multiple Vulnerabilities in WordPress
From: Henri Salo <henri () nerv fi>
Date: Wed, 25 Jan 2012 17:22:39 +0200

On Wed, Jan 25, 2012 at 08:43:34AM -0600, Trustwave Advisories wrote:
The vendor was notified. They have chosen not to fix the issue at this time. The Vendor Response section has the 

Vendor Response:
Due to the fact that the component in question is an installation script,
the vendor has stated that the attack surface is too small to warrant
a fix:

"We give priority to a better user experience at the install process. It is
unlikely a user would go to the trouble of installing a copy of WordPress
and then not finishing the setup process more-or-less immediately. The
window of opportunity for exploiting such a vulnerability is very small."

However, Trustwave SpiderLabs urges caution in situations where the
WordPress installation script is provided as part of a default image.
This is  often done as a convenience on hosting providers, even in
cases where the client does not use the software. It is a best practice
to ensure  that no installation scripts are exposed to outsiders, and
these vulnerabilities reinforce the importance of this step.

There is A LOT of these open installation pages in the Internet. It is not uncommon to leave those open by accident. 
Some people also do this, because they just don't understand the risks. I am wondering if WordPress would apply patch 
if we create one as a collaborative effort. I would be more than happy to help creating a patch for this if this is the 

- Henri Salo

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]