пятница, 5 сентября 2014 г.

WordPress 3.9.2- XXE through media upload (WAV ID3 tag)

Recently WordPress patched XXE vulnerability http://wordpress.org/news/2014/08/wordpress-3-9-2/ which were found during @ONsec_lab security audit of another one web-application.

Now time to describe this vulnerability in details!

The reason is GetID3 library which included into WordPress by default:
./wp-includes/ID3/getid3.lib.php:
521     public static function XML2array($XMLstring) {
522             if (function_exists('simplexml_load_string')) {
523                     if (function_exists('get_object_vars')) {
524                             $XMLobject = simplexml_load_string($XMLstring);

Requires PHP 5.5.0- (simple_xml was patched to disable external entities since ~5.5.0)

To use this vulnerability attacker must have privileges to upload Media (editor privileges for example).

PoC is available at our GitHub repo: https://github.com/ONsec-Lab/scripts/blob/master/getid3-xxe.wav

Timeline:
5/12/14 vendor notified
5/15/14 vulnerability confirmed
8/06/14 fixed at version 3.9.2

43 комментария:

  1. Thanks for sharing, nice post!

    Chia sẻ bí quyết kinh nghiệm mua hàng với hướng dẫn mua hàng trên aliexpress hay bài viết chia sẻ kinh nghiệm mua hàng cực chất lượng, uy tín với bài cách mua hàng aliexpress nhanh nhất và an toàn nhất hay hướng dẫn các mẹ cách mua hàng kinh nghiệm mua hàng trên aliexpress có đảm bảo an toàn, chất lương hay hàng hóa trên Aliexpress có tốt không việc mua hàng khiến nhiều người lo lắng mua hàng trên aliexpress có an toàn không mua hàng trên aliexpress có đảm bảo không cũng như cách mua như thế nào, chia sẻ các bạn cách mua hàng trên aliexpress về Việt Nam uy tín, hay ra máu báo thai có đau bụng không phải xử lý nhu thế nào hay việc thai thai 39 tuần ra dịch nhầy màu trắng có sao không, cách điều trị ra sao hay giải thích hiện tượng nút nhầy cổ tử cung có màu gì hay máu báo có thai là máu gì như thế nào hay máu báo thai ra trong mấy ngày và việc bóc tách túi thai có nguy hiểm không hay bị bóc tách túi thai nên ăn gì chế độ nghỉ ngơi như thế nào cho hợp lý.

    ОтветитьУдалить
  2. Так же я слышал про шаблоны интернет магазина wordpress, с которыми легко создавать от блогов до достаточно сложных интернет-магазинов, и не только!

    ОтветитьУдалить
  3. Bring in a present service bill to demonstrate your habitation. In many cases a permit won't have the most current address. Since service bills are paid every month, you should give the latest one.
    Payday Loans San-diego
    Cash Advance
    Auto Title Loans

    ОтветитьУдалить
  4. Этот комментарий был удален автором.

    ОтветитьУдалить
  5. Pretty nice post. I just stumbled upon your blog and wished to say that I’ve truly enjoyed surfing around your blog posts.

    Online Payday Loans
    Cash Advance Loan
    Emergency payday Loans Payday Loans
    Bad Credit

    ОтветитьУдалить
  6. Thanks for the helpful article, it gives me a lot of good information
    Nếu bạn có nhu cầu sử dụng dịch vụ vận chuyển ô tô bắc nam, thuê xe tải chở hàng, gửi xe máy bằng tàu hỏa, chuyển hàng bằng container,... hay liên hệ với proship để được tư vẫn và sử dụng dịch vụ của chúng tôi.

    ОтветитьУдалить
  7. Thanks for sharing this nice and informative article. I am really impressed! All the information is dealt with clarity.

    Want to recover from an unexpected financial emergency? Get Emergency Payday Loans Online Now.

    Online Payday Loans
    online Loans
    Cash Advance Loans
    Payday Loans
    Emergency payday Loans

    ОтветитьУдалить
  8. That's the quite different which you provide now. looking for the best online store in Newzealand. We will provide you treasurebox store items which you will be provide easily on a single click.

    ОтветитьУдалить
  9. Forever sells world-class good quality products with the help of network marketing (Direct Selling). It has various range of products like Drinks, Bee Products, Nutritional Supplements, Weight Management, Personal Care, Skin Care etc. You can see here the full catalogue of Forever Living Products. We are providing the updated Forever Living products price list

    ОтветитьУдалить

  10. Having a good username on TikTok is so important. Because if it will attractive and catchy then it helps to gain follower. Because when someone like your video then he tells to his friends and others about you and suggest them to follow you and if your username is simple and awesome then It's a big advantage for you. So you can find many TikTok Usernamehere.

    ОтветитьУдалить
  11. Roblox is a big multiplayer online game creation system. Where an user can create his own game and play it. You can create many types of games in Roblox. Roblox has 100 million monthly active users in all over the world. If you also a user of Roblox then you will definitely like these Roblox memes.

    ОтветитьУдалить
  12. If you are searching for Minecraft usernames then your search ends here. If you want a catchy, attractive and good minecraft username then you can find many Minecraft Username for boys here.

    ОтветитьУдалить
  13. High quality iPhone Cases & Covers by independent artists and designers from around the world.check it ou now in iPhone xs max cases

    ОтветитьУдалить
  14. No Credit Check Online Payday Loans Fast Nationwide USA. Get Qualified for Payday Loans Near Me Today. Fair Cash Offers. Any Location: Personal Loans, Online Title Loans Near Me, Payday Loans, Home Loans, Mortgage Loans, Hard Money Loan, and everything else! Fast Loans Nationwide USA.

    ОтветитьУдалить
  15. Need an Emotional Support Animal Letter Fast? We help people with anxiety, depression, or chronic stress connect with a mental health professional that will provide an ESA letter quickly. An emotional support animal letter can help you bring your pet into the cabin of an airplane and/or into apartment complexes without paying any fees.

    ОтветитьУдалить
  16. Этот комментарий был удален автором.

    ОтветитьУдалить
  17. Looking For a Notary Services Near Me DC, Maryland or Virginia? Need Notary Near Me DC or Maryland? 24 Hour Mobile Notary DC MD & VA; DMV Notary Mobile. Traveling Notaries that Comes to You. Notarizing Power of Attorney, Wills, Deeds, Escrow Documents, Financial Documents, Contracts, Loan Signings, Affirmations, Oaths, Apostille Services and Authentications

    ОтветитьУдалить
  18. Looking for Organic CBD Oil for Health? CBD Oil helps people with anxiety, depression, chronic stress, PTSD and many other health ailments. CBD Oil Online is finding its way into a variety of products, from tinctures and drops to CBD-infused edibles and CBD balms, as well as a wide range of cosmetics | Organic CBD Oil for Health

    ОтветитьУдалить
  19. I am impressed All the information is dealt with clarity
    check it out visit here

    ОтветитьУдалить
  20. Nice and informative. very helpful. thanks for sharing with us.
    Bonouses

    ОтветитьУдалить
  21. excellent article. Keep writing such kind of information on your blog.
    I'm really impressed by your blog.
    Hello there, You have done an incredible job. I’ll certainly Digg it and personally suggest to my friends.
    I am confident they will be benefited from this website.
    Best Offset Smokers

    ОтветитьУдалить
  22. https://www.cratoswin.com/

    Canlı bahis sitesi

    Vip casino sitesi Cratosslot

    Egt slot oyunları

    Online canlı bahis sitesi Cratossporting

    Online casino Cratosslot

    En iyi oyunlar 

    Tüm radyo frekansları için

    ОтветитьУдалить
  23. excellent article. Keep writing such kind of information on your blog.
    I'm really impressed by your blog.
    Hello there, You have done an incredible job. I’ll certainly Digg it and personally suggest to my friends.
    I am confident they will be benefited from this website.
    Best Entrepreneurship Quotes

    ОтветитьУдалить
  24. It is too important to have a good catchy and easy to remember podcast name because it helps you too much. People know you by your podacst if it is good then you will gain a good following in short time. So you can use this best best Podcast name generator to find a good name for your podcast.

    ОтветитьУдалить
  25. We Buy Houses Fast for Cash. Sell Your House Fast Nationwide USA. Fair Cash Offers. We Buy Ugly Houses. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell My House Fast House As Is.

    ОтветитьУдалить
  26. Hey Buddy, Its Nice Blog Nice Contents, found informative. Your blog is very impressive Check These guys out keep posting such useful information. I Am Also A Blogger At This Site Why Not Try This Out I Am Damn Sure You Will Really Love This Blog.

    ОтветитьУдалить
  27. I Really Enjoyed reading the Post above, really explains everything in detail, the blog is very interesting and effective. Thank you and good luck with the upcoming articles. Why Not Try This Out I Am Damn Sure You Will Really Love This Article.

    ОтветитьУдалить
  28. Very interesting, good job and thanks for sharing such a good blog. Your article is so convincing that I never stop myself to say something about it. You’re doing a great job. Keep it up.
    Actually I Thought About this

    ОтветитьУдалить
  29. I really loved reading your blog. I also found your posts very interesting. In fact, after reading, I had to go show it to my friend and he enjoyed it as well! View Publisher Site

    ОтветитьУдалить
  30. Need an Emotional Support Animal Letter Fast? We help people with anxiety, depression, or chronic stress connect with a mental health professional that will provide an ESA letter quickly. An emotional support animal letter can help you bring your pet into the cabin of an airplane and/or into apartment complexes without paying any fees.

    ОтветитьУдалить
  31. Looking For a Notary Services Near Me DC, Maryland or Virginia? Need Notary Near Me DC or Maryland? 24 Hour Mobile Notary DC MD & VA; DMV Notary Mobile. Traveling Notaries that Comes to You. Notarizing Power of Attorney, Wills, Deeds, Escrow Documents, Financial Documents, Contracts, Loan Signings, Affirmations, Oaths, Apostille Services and Authentications

    ОтветитьУдалить
  32. Online Payday Loans Fast Nationwide USA. Get Qualified for Payday Loans Near Me Today. Fair Cash Offers. Any Location: Personal Loans, Car Title Loans Online, Payday Loans, Home Loans, Small Business Loans, Registration Loans, and everything else! Fast Loans Nationwide USA.

    ОтветитьУдалить
  33. We Buy Phones Near Me DC Maryland Virginia | Cash for Electronics DC Maryland Virginia | Free iPhone Giveaway 2020! Need to Sell My iPhone, Sell Macbook Pro, Tablets or Sell Any Other Electronics? | We pay cash for electronics laptops smartphones in Washington DC Maryland Virginia & Nationwide USA

    ОтветитьУдалить