пятница, 5 сентября 2014 г.

WordPress 3.9.2- XXE through media upload (WAV ID3 tag)

Recently WordPress patched XXE vulnerability http://wordpress.org/news/2014/08/wordpress-3-9-2/ which were found during @ONsec_lab security audit of another one web-application.

Now time to describe this vulnerability in details!

The reason is GetID3 library which included into WordPress by default:
./wp-includes/ID3/getid3.lib.php:
521     public static function XML2array($XMLstring) {
522             if (function_exists('simplexml_load_string')) {
523                     if (function_exists('get_object_vars')) {
524                             $XMLobject = simplexml_load_string($XMLstring);

Requires PHP 5.5.0- (simple_xml was patched to disable external entities since ~5.5.0)

To use this vulnerability attacker must have privileges to upload Media (editor privileges for example).

PoC is available at our GitHub repo: https://github.com/ONsec-Lab/scripts/blob/master/getid3-xxe.wav

Timeline:
5/12/14 vendor notified
5/15/14 vulnerability confirmed
8/06/14 fixed at version 3.9.2

133 комментария:

  1. Thanks for sharing, nice post!

    Chia sẻ bí quyết kinh nghiệm mua hàng với hướng dẫn mua hàng trên aliexpress hay bài viết chia sẻ kinh nghiệm mua hàng cực chất lượng, uy tín với bài cách mua hàng aliexpress nhanh nhất và an toàn nhất hay hướng dẫn các mẹ cách mua hàng kinh nghiệm mua hàng trên aliexpress có đảm bảo an toàn, chất lương hay hàng hóa trên Aliexpress có tốt không việc mua hàng khiến nhiều người lo lắng mua hàng trên aliexpress có an toàn không mua hàng trên aliexpress có đảm bảo không cũng như cách mua như thế nào, chia sẻ các bạn cách mua hàng trên aliexpress về Việt Nam uy tín, hay ra máu báo thai có đau bụng không phải xử lý nhu thế nào hay việc thai thai 39 tuần ra dịch nhầy màu trắng có sao không, cách điều trị ra sao hay giải thích hiện tượng nút nhầy cổ tử cung có màu gì hay máu báo có thai là máu gì như thế nào hay máu báo thai ra trong mấy ngày và việc bóc tách túi thai có nguy hiểm không hay bị bóc tách túi thai nên ăn gì chế độ nghỉ ngơi như thế nào cho hợp lý.

    ОтветитьУдалить
    Ответы
    1. Так же я слышал про шаблоны интернет магазина wordpress, с которыми легко создавать от блогов до достаточно сложных интернет-магазинов, и не только!

      سندی

      تی ام بکس

      Удалить
    2. Deep Learning Projects assist final year students with improving your applied Deep Learning skills rapidly while allowing you to investigate an intriguing point. Furthermore, you can include Deep Learning projects for final year into your portfolio, making it simpler to get a vocation, discover cool profession openings, and Deep Learning Projects for Final Year even arrange a more significant compensation.

      Python Training in Chennai Project Centers in Chennai

      Удалить
  2. Так же я слышал про шаблоны интернет магазина wordpress, с которыми легко создавать от блогов до достаточно сложных интернет-магазинов, и не только!

    ОтветитьУдалить
  3. Bring in a present service bill to demonstrate your habitation. In many cases a permit won't have the most current address. Since service bills are paid every month, you should give the latest one.
    Payday Loans San-diego
    Cash Advance
    Auto Title Loans

    ОтветитьУдалить
  4. Этот комментарий был удален автором.

    ОтветитьУдалить
  5. Pretty nice post. I just stumbled upon your blog and wished to say that I’ve truly enjoyed surfing around your blog posts.

    Online Payday Loans
    Cash Advance Loan
    Emergency payday Loans Payday Loans
    Bad Credit

    ОтветитьУдалить
  6. Thanks for the helpful article, it gives me a lot of good information
    Nếu bạn có nhu cầu sử dụng dịch vụ vận chuyển ô tô bắc nam, thuê xe tải chở hàng, gửi xe máy bằng tàu hỏa, chuyển hàng bằng container,... hay liên hệ với proship để được tư vẫn và sử dụng dịch vụ của chúng tôi.

    ОтветитьУдалить
  7. Thanks for sharing this nice and informative article. I am really impressed! All the information is dealt with clarity.

    Want to recover from an unexpected financial emergency? Get Emergency Payday Loans Online Now.

    Online Payday Loans
    online Loans
    Cash Advance Loans
    Payday Loans
    Emergency payday Loans

    ОтветитьУдалить
  8. That's the quite different which you provide now. looking for the best online store in Newzealand. We will provide you treasurebox store items which you will be provide easily on a single click.

    ОтветитьУдалить
  9. Forever sells world-class good quality products with the help of network marketing (Direct Selling). It has various range of products like Drinks, Bee Products, Nutritional Supplements, Weight Management, Personal Care, Skin Care etc. You can see here the full catalogue of Forever Living Products. We are providing the updated Forever Living products price list

    ОтветитьУдалить

  10. Having a good username on TikTok is so important. Because if it will attractive and catchy then it helps to gain follower. Because when someone like your video then he tells to his friends and others about you and suggest them to follow you and if your username is simple and awesome then It's a big advantage for you. So you can find many TikTok Usernamehere.

    ОтветитьУдалить
  11. Roblox is a big multiplayer online game creation system. Where an user can create his own game and play it. You can create many types of games in Roblox. Roblox has 100 million monthly active users in all over the world. If you also a user of Roblox then you will definitely like these Roblox memes.

    ОтветитьУдалить
  12. If you are searching for Minecraft usernames then your search ends here. If you want a catchy, attractive and good minecraft username then you can find many Minecraft Username for boys here.

    ОтветитьУдалить
  13. High quality iPhone Cases & Covers by independent artists and designers from around the world.check it ou now in iPhone xs max cases

    ОтветитьУдалить
  14. No Credit Check Online Payday Loans Fast Nationwide USA. Get Qualified for Payday Loans Near Me Today. Fair Cash Offers. Any Location: Personal Loans, Online Title Loans Near Me, Payday Loans, Home Loans, Mortgage Loans, Hard Money Loan, and everything else! Fast Loans Nationwide USA.

    ОтветитьУдалить
  15. Need an Emotional Support Animal Letter Fast? We help people with anxiety, depression, or chronic stress connect with a mental health professional that will provide an ESA letter quickly. An emotional support animal letter can help you bring your pet into the cabin of an airplane and/or into apartment complexes without paying any fees.

    ОтветитьУдалить
  16. Этот комментарий был удален автором.

    ОтветитьУдалить
  17. Looking For a Notary Services Near Me DC, Maryland or Virginia? Need Notary Near Me DC or Maryland? 24 Hour Mobile Notary DC MD & VA; DMV Notary Mobile. Traveling Notaries that Comes to You. Notarizing Power of Attorney, Wills, Deeds, Escrow Documents, Financial Documents, Contracts, Loan Signings, Affirmations, Oaths, Apostille Services and Authentications

    ОтветитьУдалить
  18. Looking for Organic CBD Oil for Health? CBD Oil helps people with anxiety, depression, chronic stress, PTSD and many other health ailments. CBD Oil Online is finding its way into a variety of products, from tinctures and drops to CBD-infused edibles and CBD balms, as well as a wide range of cosmetics | Organic CBD Oil for Health

    ОтветитьУдалить
  19. I am impressed All the information is dealt with clarity
    check it out visit here

    ОтветитьУдалить
  20. Nice and informative. very helpful. thanks for sharing with us.
    Bonouses

    ОтветитьУдалить
  21. excellent article. Keep writing such kind of information on your blog.
    I'm really impressed by your blog.
    Hello there, You have done an incredible job. I’ll certainly Digg it and personally suggest to my friends.
    I am confident they will be benefited from this website.
    Best Offset Smokers

    ОтветитьУдалить
  22. https://www.cratoswin.com/

    Canlı bahis sitesi

    Vip casino sitesi Cratosslot

    Egt slot oyunları

    Online canlı bahis sitesi Cratossporting

    Online casino Cratosslot

    En iyi oyunlar 

    Tüm radyo frekansları için

    ОтветитьУдалить
  23. excellent article. Keep writing such kind of information on your blog.
    I'm really impressed by your blog.
    Hello there, You have done an incredible job. I’ll certainly Digg it and personally suggest to my friends.
    I am confident they will be benefited from this website.
    Best Entrepreneurship Quotes

    ОтветитьУдалить
  24. It is too important to have a good catchy and easy to remember podcast name because it helps you too much. People know you by your podacst if it is good then you will gain a good following in short time. So you can use this best best Podcast name generator to find a good name for your podcast.

    ОтветитьУдалить
  25. We Buy Houses Fast for Cash. Sell Your House Fast Nationwide USA. Fair Cash Offers. We Buy Ugly Houses. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell My House Fast House As Is.

    ОтветитьУдалить
  26. Hey Buddy, Its Nice Blog Nice Contents, found informative. Your blog is very impressive Check These guys out keep posting such useful information. I Am Also A Blogger At This Site Why Not Try This Out I Am Damn Sure You Will Really Love This Blog.

    ОтветитьУдалить
  27. I Really Enjoyed reading the Post above, really explains everything in detail, the blog is very interesting and effective. Thank you and good luck with the upcoming articles. Why Not Try This Out I Am Damn Sure You Will Really Love This Article.

    ОтветитьУдалить
  28. Very interesting, good job and thanks for sharing such a good blog. Your article is so convincing that I never stop myself to say something about it. You’re doing a great job. Keep it up.
    Actually I Thought About this

    ОтветитьУдалить
  29. I really loved reading your blog. I also found your posts very interesting. In fact, after reading, I had to go show it to my friend and he enjoyed it as well! View Publisher Site

    ОтветитьУдалить
  30. Need an Emotional Support Animal Letter Fast? We help people with anxiety, depression, or chronic stress connect with a mental health professional that will provide an ESA letter quickly. An emotional support animal letter can help you bring your pet into the cabin of an airplane and/or into apartment complexes without paying any fees.

    ОтветитьУдалить
  31. Looking For a Notary Services Near Me DC, Maryland or Virginia? Need Notary Near Me DC or Maryland? 24 Hour Mobile Notary DC MD & VA; DMV Notary Mobile. Traveling Notaries that Comes to You. Notarizing Power of Attorney, Wills, Deeds, Escrow Documents, Financial Documents, Contracts, Loan Signings, Affirmations, Oaths, Apostille Services and Authentications

    ОтветитьУдалить
  32. Online Payday Loans Fast Nationwide USA. Get Qualified for Payday Loans Near Me Today. Fair Cash Offers. Any Location: Personal Loans, Car Title Loans Online, Payday Loans, Home Loans, Small Business Loans, Registration Loans, and everything else! Fast Loans Nationwide USA.

    ОтветитьУдалить
  33. We Buy Phones Near Me DC Maryland Virginia | Cash for Electronics DC Maryland Virginia | Free iPhone Giveaway 2020! Need to Sell My iPhone, Sell Macbook Pro, Tablets or Sell Any Other Electronics? | We pay cash for electronics laptops smartphones in Washington DC Maryland Virginia & Nationwide USA

    ОтветитьУдалить
  34. Welcome to Secret Room. We have brought you an international clubbing experience unlike anything in Dubai. Our unique space with mind blowing interior opens its doors for you to explore the sophisticated “Like Home” feeling.

    ОтветитьУдалить
  35. Wonderful post, keep on giving such information in future also I want to share something with.. and we provide Web Development Service in india.

    ОтветитьУдалить
  36. What’s up everyone, it’s my first visit at this web site, and
    paragraph is actually fruitful for me, keep up posting these articles.
    https://germanbrain.com/

    ОтветитьУдалить
  37. 123.hp.com - Set up your 123 HP Printer at 123.hp.com Latest driver Download and install your 123.hp.com/setup printer software and Get Our Experts help.

    ОтветитьУдалить
  38. https://www.egypsaparking.com/ar/%d9%86%d8%b8%d8%a7%d9%85-%d9%85%d9%88%d8%a7%d9%82%d9%81-%d8%a7%d9%84%d8%b3%d9%8a%d8%a7%d8%b1%d8%a7%d8%aa-%d8%a7%d9%84%d8%a3%d9%88%d8%aa%d9%88%d9%85%d8%a7%d8%aa%d9%8a%d9%83%d9%8a-%d9%85%d8%b5%d8%b1/

    ОтветитьУдалить
  39. We are well established IT and outsourcing firm working in the market since 2013. We are providing training to the people ,
    like- Web Design , Graphics Design , SEO, CPA Marketing & YouTube Marketing.Call us Now whatsapp: +(88) 01537587949
    :seo service company in Bangladesh
    Free bangla sex video:careful
    good post outsourcing institute in bangladesh

    ОтветитьУдалить
  40. agahi-kala

    درج آگهي در اين سايت رايگان است و مسئوليت تبليغ خلاف واقع به عهده سفارش دهنده و سازنده آگهي مي باشد.


    ОтветитьУдалить
  41. Sell My House Fast Alabama for Cash. Sell House Fast Alabama Nationwide USA. Fair Cash Offers. We Buy Houses Alabama. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell House As Is.

    ОтветитьУдалить
  42. Sell My House Fast for Cash. Sell Your House Fast Nationwide USA. Fair Cash Offers. We Buy Houses. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell House As Is.

    ОтветитьУдалить
  43. Sell My House Fast for Cash. Sell Your House Fast Nationwide USA. Fair Cash Offers. We Buy Houses. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell House As Is.

    ОтветитьУдалить
  44. Would-be medical exec from Iran barred from Canada over alleged ties to Tehran's nuclear program. Ramin Fallah was labeled a security threat because he ...

    khabarbaran
    from-iran
    from-canada
    labeled-a-security
    tehrans-nuclear

    ОтветитьУдалить
  45. Recently I ordered a job on the extraessay reviews. The author openly communicated with me throughout the creation of the work, specified certain points, agreed on sources and so on. In general, I liked the quality of work, and the quality of communication with the writer did not lag behind.

    ОтветитьУдалить
  46. Sell My House Fast for Cash Nationwide USA. We Buy Houses. Fair Cash Offers. We Buy Houses Florida. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. https://www.sellmyhousefastflorida.com/

    ОтветитьУдалить
  47. I know a number of venues for dating, but they're all boring and uninteresting and you can't locate a nice girl. A buddy of mine once informed me this lithuanian women dating service, that helped me locate a Lithuanian girl, and we were in a few of minutes already! I'd also want to have a look at the amazing architecture of this dating site, since other websites are really boring and are not simple, so it's not! I was quite satisfied with it.

    ОтветитьУдалить
  48. We Buy Phones Near Me Miami South Florida | Cash for Electronics Miami South Florida | Need to Sell My iPhone, Sell My Laptop Near Me, Tablets or Sell Any Other Electronics? | We pay cash for electronics laptops smartphones in Miami Florida & Nationwide USA

    ОтветитьУдалить
  49. Admissioninbangalore provides best conscelling for engineering, Nrsing, Degree Colleges, etc. in Bangalore.
    rv college of engineering admission

    ОтветитьУдалить
  50. Sell My House Fast for Cash Nationwide USA. We Buy Houses. Fair Cash Offers. We Buy Houses NY. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell My House Fast New York.

    ОтветитьУдалить
    Ответы
    1. Sell My House Fast for Cash Nationwide USA. We Buy Houses. Fair Cash Offers. We Buy Houses NY. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell My House Fast New York

      Удалить
  51. Good morning, I want to recommend today the greatest site to prepare successfully for tests. I personally found this site with the help of my friends. I went to myexamcoach.com website men, and in the shortest possible period they prepared me for tests. You may also hire an individual on this website to test yourself.

    ОтветитьУдалить
  52. great submit, very informative. I’m wondering why the other experts of this sector do not notice this. You must continue your writing. I am confident, you have a great readers’ base already!

    한국야동

    ОтветитьУдалить
  53. I love your blog.. very nice colors & theme. Did you create this website yourselfor did you hire someone to do it for you? Plz reply as I'm looking to create my own blog and would like to find out where u got this from. thanks a lot

    일본야동

    ОтветитьУдалить
  54. It is very rare these days to find sites that provide information someone is watching for. I am glad to see that your site share valued information that can help to many readers. nice one and keep writing!
    일본야동

    ОтветитьУдалить
  55. Hi there, You have done an excellent job. I will certainly digg it and personally suggest to my friends.

    한국야동

    ОтветитьУдалить
  56. I am confident they will be benefited from this web site. 국산야동

    ОтветитьУдалить
  57. Thank you for the useful information which you shared throughout your blog. I appreciate the way you shared the relevant, precious, and perfect information. Furthermore, I would like to share some information about intouchgroup. intouchgroup is the website designing company in Delhi, to know more about the services, just visit the website and take complete information about intouchgroup. I hope, you will get immediate assistance and the right information through the website.

    ОтветитьУдалить
  58. Thank you for the useful information which you shared throughout your blog. I appreciate the way you shared the relevant, precious, and perfect information. Furthermore, I would like to share some information about peergrowth. peergrowth is the best recruitment firms in dubai, to know more about the services, just visit the website and take complete information about peergrowth. I hope, you will get immediate assistance and the right information through the website.

    ОтветитьУдалить
  59. We Buy Houses Fast for Cash. Sell Your House Fast Nationwide USA. Fair Cash Offers. We Buy Ugly Houses. Any Location, Houses & Land: Residential, Commercial, Industrial, Agricultural. Sell My House Fast

    ОтветитьУдалить
  60. STAFABAND tempat download lagu terbaru disertai lirik dan full Album. Gudang lagu mp3 terlengkap dengan gambar album. Genre POP, KPOP, religi dan lagu barat terbaik. Stafaband

    ОтветитьУдалить
  61. Gudang lagu mp3 terbaru, download lagu mp3 terbaik gratis, dengarkan lagu mp3 secara online, top download lagu Indonesia. Download lagu

    ОтветитьУдалить
  62. Do you want to create new blockchain wallet but you don’t know how to do start but that is But it's not as easy as we think we don’t worry because we have expert team and you can contact blockchain support number get help

    ОтветитьУдалить
  63. Assam Career | Jobs in Assam | Jobs in Guwahati | Assam Tips
    Assam Tips is the trusted website to find latest jobs in Assam. Get information on govt jobs in Assam
    job in assam

    ОтветитьУдалить
  64. Connect Dubai Fun Club for premium Dubai Escorts and entertainment services. You can easily find the best call girls in Dubai on our website.

    ОтветитьУдалить
  65. IMBMS (Indian Medical Business Management System) is one of the most active retail suppliers providing thorough supply of various personal care products. We believe in distributing the utmost genuine and trusted range of skin whitening products & fairness cosmetics and whitening night creams throughout the nation.

    Skin whitening injection

    ОтветитьУдалить
  66. Prism Lead India is a Lead generation company that helps businesses to grow and make their sales process easier.
    If you’re moving house, you have to have the right movers for the job. If you’re moving, you need to trust the people helping you. Moving is stressful enough without having to worry about your belongings. Having the right movers can make the process even easier.

    There are so many moving companies in the city and not enough people know which one to go for. When you travel with a friend to the city, do you ever go to the office without checking if a specific company is available for your move-in, or do you pick from the options which are nearby? With a bigger city like Bengaluru,packers and movers electronic city choosing the right company for your move can be overwhelming.
    They are also provide that other service like Computer reapir shop near me laptop repair shop in bangalore
    The same goes for hiring moving companies.Packers and movers marathahalli If you’re moving and need just the right moving company, e.g. home packing, Packers and movers whitefield you don’t want to find out your moving company isn’t available after a month by switching back and forth and end up with an in-between moving job. This is where our team at Packers and Movers Bangalore helps! We have 6000+ satisfied customers in the last 4 years, demonstrating that our customers get the best moving experience possible.

    It can take 10 days just to compare the rates of moving companies. packers and movers hsr layoutThis means your budget is limited for starting with one moving company. By selecting a moving company which is locally owned and providing the best movers and companies, you’re ensuring the best move experience in a realistic time frame. You’ll save money and stress by switching to a local company. We also provide flat shipment and security deposit for our customers.

    Generally, moving companies charge for moving goods and the extra charges pay the company’s little commission. When the buyer moves out, they’d be paying for packing, transportation, and storing of their belongings. packers and movers Bommanahalli Packaging and storing charges can outweigh the moving price estimate by a large margin.
    Moving is such a costly process. With the right movers you can avoid extra charges by hiring the local packers and packers who are very affordable. packers and movers yeshwanthpur
    Packers and movers yelahanka you can visit our website for more details about more services.

    ОтветитьУдалить
  67. hey admin i want to tell you something about your work thanks for sharing you content with keep it up
    web development company

    ОтветитьУдалить
  68. This a very useful article with incredible contents, really appreciate your time taken in sharing this. delsu post utme cut off mark

    ОтветитьУдалить
  69. My mother has been forcing me to marry literally for several years, I have been avoiding answering this for a long time, but I myself have already thought and understood that it is time. On the street, not an option to meet, but in a tinder and other girls for one night. I saw this site for a russian mail order bride, and immediately registered, a bunch of profiles of different beautiful girls, met one and I think to invite her on a second date, thanks to this project for their work and wish you success.

    ОтветитьУдалить
  70. Prism Lead India is the best business listing company in Bangalore where you will get all types of services like, Pest control service in Bangalore, bathroom cleaning services in Bangalore, AC Repair Service, computer repair shop in bangalore, Water Tank Cleaning, Home Cleaning, Packers and Movers, Home Painting, computer repairing shops in Bangalore, etc.

    Our comprehensive pest control service includes disinsection, deratization, and sanitation. The objective is to keep the populations of vector-pest agents controlled, through intensive surveillance that includes: reports, inspections, and monthly treatments. Prism LEAD INDIA puts safe and harmless technologies at your disposal.


    Our comprehensive pest control service includes disinsection, deratization, and sanitation. The objective is to keep the populations of vector-pest agents controlled, through intensive surveillance that includes: reports, inspections, and monthly treatments. Prism LEAD INDIA puts safe and harmless technologies at your disposal.
    The service includes pest control service in Bangalore and incorporates preventive and corrective measures to eliminate the presence of vectors, in order to minimize the economic damage for the client.
    The key to effective pest elimination consists of manipulating the factors that limit the reproduction and survival potential of each pest. This occasionally involves the use of pesticides, but sanitation is preferred as a control mechanism, in order to minimize risk or harm to man and the environment. Additionally we provides laptop repairing shops in Bangalore
    RISK FACTOR
    The removal of food, water, and possible shelters has a very significant impact on the pest populations to be controlled; These characteristics define the load capacity of an enclosure. In collaboration with the client, our task is to minimize these three factors by reducing the spread of pests.
    It is necessary to carry out preventive actions regularly, for which we offer regular and planned maintenance programs, usually annually; the frequency is defined according to the needs of the enclosure to be protected. We are the top rated packers and movers in bangalore. We do all kinds of packing and moving services in india.

    pest control bangalore
    packers and movers in bangalore
    bathroom cleaning services in bangalore
    computer repair shop in Bangalore
    laptop-repair shop in Bangalore

    ОтветитьУдалить
  71. Oh my goodness! an amazing article dude. Thank you However I am experiencing issue with ur rss. Don’t know why Unable to subscribe to it. Is there anyone getting identical rss problem? Anyone who knows kindly respond. Thnkx

    Click Here
    Visit Web
    Clyp.it

    ОтветитьУдалить