January 25, 2012, 7:57AM
Multiple Bugs Haunt WordPress Setup
7 Comments
Researchers have found a string of weaknesses in the WordPress default installation page, including PHP code execution and a persistent cross-site scripting flaw, affecting versions 3.3.1 and later. WordPress officials say that they're not planning to fix the vulnerabilities as there's only a small possibility of exploitation by attackers.
The flaws were found by researchers at TrustWave's SpiderLabs, and in their advisory on the WordPress bugs, they describe how attackers would be able to exploit them. In the advisory, the researchers also include code that can be used to demonstrate the problems. Executing attacks on the vulnerabilities does require some specific conditions to be present.
"The WordPress 'setup-config.php' installation page allows users to install WordPress in local or remote MySQL databases. This typically requires a user to have valid MySQL credentials to complete. However, a malicious user can host their own MySQL database server and can successfully complete the WordPress installation without having valid credentials on the target system. After the successful installation of WordPress, a malicious user can inject malicious PHP code via the WordPress Themes editor. In addition, with control of the database store, malicious Javascript can be injected into the content of WordPress yielding persistent Cross Site Scripting," the advisory says in describing the XSS and PHP code execution bugs.
There also are other XSS vulnerabilities in the setup page for WordPress installations.
"The WordPress 'setup-config.php' installation page allows users to install WordPress in local or remote MySQL databases. When using this installation page the user is asked to supply the database name, the server that the database resides on, and a valid MySQL username and password. During this process, malicious users can supply javascript within the "dbname", "dbhost" or "uname" parameters. Upon clicking the submission button, the javascript is rendered in the client's browser," the advisory says.
Officials from WordPress said that there is little risk of exploitation, so they will not be publishing patches for the vulnerabilities.
"We give priority to a better user experience at the install process. It is unlikely a user would go to the trouble of installing a copy of WordPress and then not finishing the setup process more-or-less immediately. The window of opportunity for exploiting such a vulnerability is very small," WordPress officials said in response to the disclosures.
Recommended Reads
Commenting on this Article will be automatically closed on April 25, 2012.
Today's Most Popular
Most Commented Stories
Newsletter Sign-up
Take Our Poll
Do researchers have a moral responsibility to withhold SCADA vulns?
Yes, they shouldn't be published until vendors fix them.
5%
Vendors should be notified, and given a reasonable amount of time to resolve.
44%
Forget vendors, let's break the Internet.
3%
SCADA vulns are FUD.
0%
You can't blame researchers for pointing out shoddy software.
49%
Total votes: 39
Follow Threatpost
 |  |  |  |
| Tumblr |
Comments
"WordPress officials say that they're not planning to fix the vulnerabilities as there's only a small possibility of exploitation by attackers."
Proves that they dont care about security and that their products and services should be abandoned by all.
Easier said than done if you aren't computer literate and you pay folks to set things up. You just have to hope for the best. WordPress if free, so I can see why whoever maintains and runs it for nothing isn't gung-ho to fix this.
What's a good alternative to Wordpress for someone who wants to link a blog to a website. That's for someone who doesn't know codes.
Your comments prove that you do not fully understand the situation, maybe you should do some research before you jump to conclusions. If a blog is fully set up (not a very long or dificult process) the attack window closes. Stop commenting on things you do not understand.
Why are you that RUDE? Each and every minute Microsoft Teams MAKE THE SAME DECISION about security threats FIXES they POSTPONED arguably, just for some respectable cost considerations and PRIORITY as well. Probabilities is USED in so many AREAS (insurances etc...) that BEING A PURIST looks like HAVING NOT GOT THE BIG PICTURE! AT ALL!
IMHO, you should throw away Windows 7 whatsoever, before feeling neglected by an open source blog service, which IS NOT PERFECT, but which is NOT THAT BAD at users, as your stance might suppose.
It is good to know about this flaw. I use wordpress to all my sites.
One very important thing to keep in mind is backup folders. Once you rename a /wordpress or /blog folder with a backup name, this breaks the installation and re-opens the vulnerability... Thanks for this post - we're ridding this file from active/inactive Wordpress installations.
Post new comment