Wordpress Zero Day
- Thread starter trophaeum
- Start date
teeniegenie
Supreme Member
- Aug 28, 2010
- 1,294
- 666
SahL - Which file in the WP editor should I search? The style.css file? I have close to 30 different files I'll need to search if I do this manually...
I am using a theme from PageLines FWIW...
I am using a theme from PageLines FWIW...
SOCOM
Elite Member
- Jul 21, 2010
- 4,298
- 3,267
SahL - Which file in the WP editor should I search? The style.css file? I have close to 30 different files I'll need to search if I do this manually...
I am using a theme from PageLines FWIW...
Go to Cpanel and type timthumb.php and edit it through there
bezopravin
BANNED
- May 11, 2010
- 460
- 3,494
wp eStore plugin by tipsandtricks-hq uses timthumb.php. If you installed that plugin, deactivate it ASAP & switch to other ecommerce plugins like wp ecommerce,eshop or cart66.
bertbaby
Elite Member
- Apr 15, 2009
- 2,025
- 1,535
Here's more on the exploit which can be found in dozens of themes downloadable at BHW and I found the file on one of my blogs:
TENS OR HUNDREDS OF THOUSANDS of Wordpress installations are at risk of being compromised because of a critical vulnerability in a popular third-party image manipulation script called timthumb.
The affected image utility is not part of the main Wordpress package, but is incorporated in many popular Wordpress themes. The script consists of a single file called timthumb.php and facilitates on-the-fly image cropping, zooming and resizing.
Timthumb defines a white list of remote domain names from which images can be fetched by default, which include popular image hosting web sites like Flickr.com, Picasa.com, Blogger.com, Wordpress.com, Photobucket.com and others.
However, the script fails to validate these domain names properly, so it lets files be fetched from nasty hosts that include those strings in their URLs. For example, files from "http://flickr.com.maliciousdomain.com" are accepted because "flickr.com" is in the URL, even though it is not the actual domain name. And since fetched files are stored in a cache directory before processing, the vulnerability opens a back door through which malicious attackers can upload and execute PHP shells on the server.
"Timthumb.php is inherently insecure because it relies on being able to write files into a directory that is accessible by people visiting your website. That's never a good idea," warned Feedjit CEO Mark Maunder, who discovered the flaw when his blog was hacked.
Searching on Google for the script's file name returns over 39 million results. That is not the actual number of vulnerable websites, but if even ten per cent of those are individual blogs, the flaw's impact is still huge.
Wordpress vulnerabilities have been exploited in the past to inject malicious code into blogs that directed their visitors to malware. However, this vulnerability is even more serious because deploying a patch for it will not be easy.
There are currently a large number of outdated and vulnerable Wordpress installations, even though the platform offers a simple update mechanism and its developers quickly patch any security issues.
In comparison, Wordpress themes are rarely updated and do not benefit from the same type of support from their creators. This fragmentation will make mass patch deployment very difficult and will leave webmasters to fend for themselves.
"Check [to see] if any of the blogs you host use timthumb.php, and upgrade to the latest version. The dodgy strpos [php function] has been replaced with a tighter match based on a regular expression," advises Paul Ducklin, head of technology for Asia Pacific at security firm Sophos
Read more: http://www.theinquirer.net/inquirer/news/2099162/wordpress-blogs-risk#ixzz1TzfgFmaC
TENS OR HUNDREDS OF THOUSANDS of Wordpress installations are at risk of being compromised because of a critical vulnerability in a popular third-party image manipulation script called timthumb.
The affected image utility is not part of the main Wordpress package, but is incorporated in many popular Wordpress themes. The script consists of a single file called timthumb.php and facilitates on-the-fly image cropping, zooming and resizing.
Timthumb defines a white list of remote domain names from which images can be fetched by default, which include popular image hosting web sites like Flickr.com, Picasa.com, Blogger.com, Wordpress.com, Photobucket.com and others.
However, the script fails to validate these domain names properly, so it lets files be fetched from nasty hosts that include those strings in their URLs. For example, files from "http://flickr.com.maliciousdomain.com" are accepted because "flickr.com" is in the URL, even though it is not the actual domain name. And since fetched files are stored in a cache directory before processing, the vulnerability opens a back door through which malicious attackers can upload and execute PHP shells on the server.
"Timthumb.php is inherently insecure because it relies on being able to write files into a directory that is accessible by people visiting your website. That's never a good idea," warned Feedjit CEO Mark Maunder, who discovered the flaw when his blog was hacked.
Searching on Google for the script's file name returns over 39 million results. That is not the actual number of vulnerable websites, but if even ten per cent of those are individual blogs, the flaw's impact is still huge.
Wordpress vulnerabilities have been exploited in the past to inject malicious code into blogs that directed their visitors to malware. However, this vulnerability is even more serious because deploying a patch for it will not be easy.
There are currently a large number of outdated and vulnerable Wordpress installations, even though the platform offers a simple update mechanism and its developers quickly patch any security issues.
In comparison, Wordpress themes are rarely updated and do not benefit from the same type of support from their creators. This fragmentation will make mass patch deployment very difficult and will leave webmasters to fend for themselves.
"Check [to see] if any of the blogs you host use timthumb.php, and upgrade to the latest version. The dodgy strpos [php function] has been replaced with a tighter match based on a regular expression," advises Paul Ducklin, head of technology for Asia Pacific at security firm Sophos
Read more: http://www.theinquirer.net/inquirer/news/2099162/wordpress-blogs-risk#ixzz1TzfgFmaC
bertbaby
Elite Member
- Apr 15, 2009
- 2,025
- 1,535
Replace the timthump.php file in your blog theme with this update to close the vulnerability:
http://code.google.com/p/timthumb/
That said looking at the the Timthumb issue stack I'm not necessarily sure that the developer has completely closed the exploit since the status says started:
212 Defect Started Medium ---- ---- Zero day vulnerability that gives remote attacker shell access
217 Defect Started Medium ---- ---- Timthumb must not use web accessible dir as cache
http://code.google.com/p/timthumb/
That said looking at the the Timthumb issue stack I'm not necessarily sure that the developer has completely closed the exploit since the status says started:
212 Defect Started Medium ---- ---- Zero day vulnerability that gives remote attacker shell access
217 Defect Started Medium ---- ---- Timthumb must not use web accessible dir as cache
Last edited:
┼blackrat┼
Senior Member
- Jul 31, 2010
- 980
- 799
tiagorossi
Junior Member
- Aug 2, 2011
- 174
- 51
This security flaw also applies to all of your inactive themes. If you have any theme, even if it is inactive, that contains the timthumb.php file then you are potentially at risk. I would suggest deleting all of the themes that you are not using in addition to updating the ones that you are.
Did anyone tested it with any malicious code ?
the milw0rm does not mentions that we should be a user of the wordpress with image upload permission.
Can anyone confirm this ? If this is the case then it's not that serious until we have users on our wordpress.
the milw0rm does not mentions that we should be a user of the wordpress with image upload permission.
Can anyone confirm this ? If this is the case then it's not that serious until we have users on our wordpress.
- Jun 23, 2010
- 2,141
- 5,063
Using this option, cpanel didn't return any results for "timthumb" for me. I know its there because I manually checked in a few installations.
billbobi
Regular Member
- Apr 16, 2010
- 233
- 47
Go into the file manager in cpanel and search your entire home directory.. That's what I did.
- Jun 23, 2010
- 2,141
- 5,063
I already found all the installations of it using ftp. I was just pointing out the other method posted didn't work for me, so that others don't assume its not there just because cpanel search didn't fetch any results.