Wordpress Zero Day

trophaeum · Aug 3, 2011

just a thread to reference from the announcement, chat among yourselves in here about it

http://www.blackhatworld.com/blackhat-seo/blackhat-lounge/announcements.html

redstone.1337 · Aug 3, 2011

Thanks for posting this. Gotta check my sites.

trophaeum · Aug 3, 2011

fwiw, all woothemes use it for a start, not sure who/what else, this is gonna be brutal

SahL · Aug 3, 2011

ATTENTION : Hackers are using blogger and wordpress and other external sites to load the script.

"So if you create a file on a web server like so: http://blogger.com.somebadhackersite.com/badscript.php
and tell timthumb.php to fetch it, it merrily fetches the file and puts it in the cache directory ready for execution,"

I recommend all BHW members having timthumb.php in their themes to :

1 : update the timthumb.php from here : http://timthumb.googlecode.com/svn/trunk/timthumb.php (just copy and paste(replace))
2 : edit and remove blogger,flicker,picasa,wordpress from // external domains.

----------------------------------------------------------------------------------------
Its should then look something like this :
-----------------------------------------------------------------------------------------

// external domains that are allowed to be displayed on your website
$allowedSites = array (
'img.youtube.com',
'www.youtube.com',

);

trophaeum · Aug 3, 2011

SahL said:
Does updating the timthumb Prevent it ???

Or

even the updated version is vulnerable.

yup, updating should work fine now, at least according to the svn commit log, i didnt dig into it much further yet, figured it should go up on bhw asap since you guys run a zillion wp sites among ya's

alexsize · Aug 3, 2011

User must be registered.
User must have the right to fill the image.
Vulnerable only to the theme with file timthumb.php
IMHO Tempest in a teapot.

trophaeum · Aug 3, 2011

alexsize said:
User must be registered.
User must have the right to fill the image.
Vulnerable only to the theme with file timthumb.php
IMHO Tempest in a teapot.

wpms/mu, user contributed content, theres still plenty of options here

as for only themes with timthumb, go check, its a LOT of them

cecle · Aug 3, 2011

trophaeum said:
as for only themes with timthumb, go check, its a LOT of them

So to clarify only themes that show timthumb.php in the editor interface are at risk? Just to make sure it can't have been placed elsewhere.

SahL · Aug 3, 2011

trophaeum said:
yup, updating should work fine now, at least according to the svn commit log, i didnt dig into it much further yet, figured it should go up on bhw asap since you guys run a zillion wp sites among ya's

If the script can be loaded by external sites, its still vulnerable as the updated

Timthumb.php still has blogger, and wordpress.com as "Allowed external sites".

cecle said:
So to clarify only themes that show timthumb.php in the editor interface are at risk? Just to make sure it can't have been placed elsewhere.

Mostly themes which CAN auto-fetch Images from the post ,resize it , have timthumb.php.

But i dont think that blogger or wordpress would provide php or other scripting support,

so there might be another way by which they are breaking in

trophaeum · Aug 3, 2011

SahL said:
If the script can be loaded by external sites, its still vulnerable as the updated

Timthumb.php still has blogger, and wordpress.com as "Allowed external sites".

Mostly themes which CAN auto-fetch Images from the post ,resize it , have timthumb.php.

But i dont think that blogger or wordpress would provide php or other scripting support,

so there might be another way by which they are breaking in

you can use blogspot.com.mydomain.co.cc (or dyndns etc) in the exploitable ver, the allowed list checking code changed

ug, my head isnt working so well atm, ill come back to the thread after dinner/caffeine

IamNRE · Aug 3, 2011

Noob alert!

Is timthumb.php something all wordpress sites have installed or not? I have tried looking for the file in my ftp... no luck.

SahL · Aug 3, 2011

IamNRE said:
Noob alert!

Is timthumb.php something all wordpress sites have installed or not? I have tried looking for the file in my ftp... no luck.

Mostly themes which Can AUTO-Fetch Images from the post ,resize it , have timthumb.php.
----------------------------------------------------------------------------------------------------------
As per my Knowledge mostly latest premium themes have it.

eg as trophaeum said, all woothemes have it now.

others would be elegant themes and many from theme forest.

MarketerX · Aug 3, 2011

Whats the easiest way to see if a site is using this plugin??

IamNRE · Aug 3, 2011

Like MarketerX said,

where is the typical location of this file on ftp?

Is it under the current theme one is using? If so... I dont think I have it....tho not 100%...eeek

ronywilliam · Aug 3, 2011

Can somebody post a bit detailed guide to get around this? Or a fix?

Edit: Gotcha. You just need to copy paste and save! thx

SahL · Aug 3, 2011

IamNRE said:
Like MarketerX said,

where is the typical location of this file on ftp?

Is it under the current theme one is using? If so... I dont think I have it....tho not 100%...eeek

Location would be only in theme files.

In the wordpress dashboard Go to>appearance>>editor>

search timthumb if not found its not there.

-------------------------------------------------------------------------------------------

in ftp you can go to your theme file (active theme)and look for timthumb.php if its not

there ..it wont be anywhere else..so relax

ronywilliam said:
Can somebody post a bit detailed guide to get around this? Or a fix?

this little guide which i have written is all that you need :

Code:

http://www.blackhatworld.com/blackhat-seo/3092988-post4.html

- SahL

redstone.1337 · Aug 3, 2011

IamNRE said:
Noob alert!

Is timthumb.php something all wordpress sites have installed or not? I have tried looking for the file in my ftp... no luck.

Use cPanel's search option at top right. Search "timthumb" and it will show you the location of all timthumb.php in your particular cPanel account.

cbnoob · Aug 3, 2011

So where is timthumb.php? I can't find it in my sites. I use free wordpress themes for all sites now

TNphoneman · Aug 3, 2011

cbnoob said:
So where is timthumb.php? I can't find it in my sites. I use free wordpress themes for all sites now

Your themes probably don't use it if it is not there. Normally you will find it in the folder for that theme.

On another note the older Elegant Themes did use the timthumb but the newer ones do not. The have all been updated on the site but I just updated the php file instead of losing my modifications.

TropicalSun · Aug 3, 2011

alexsize said:
User must be registered.
User must have the right to fill the image.
Vulnerable only to the theme with file timthumb.php
IMHO Tempest in a teapot.

wow that reassuring! I don't allow for any users on my blogs but do use Woo themes!

Hope everyone else doesn't have big problems with this though.

Wordpress Zero Day

Senior Member

BANNED

Senior Member

Elite Member

Senior Member

Newbie

Senior Member

Regular Member

Elite Member

Senior Member

Elite Member

Elite Member

Regular Member

Elite Member

Senior Member

Elite Member

BANNED

Senior Member

Senior Member

Regular Member

Main Menu

Marketplace

Making Money

BlackHat World