WordPress Exploit Allows Admin Password Reset 100
Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.
Clarification (Score:5, Informative)
For those who don't RTFA, this doesn't give the attacker access to the new, reset, password. That requires access to the admin's mailbox as well. So the link saying "lock an admin out" is a bit, well, not completely true. It could be true if his/her inbox is hacked, but not otherwise.
Re:Clarification (Score:5, Insightful)
While you're right in saying the attacker can't access the admin's account, the admin themselves also can't access it, because their password has already been reset to something else, and they'll have to get the new one. It seems more like a minor inconvenience to me, then a massive bug which will end the world, but still a flaw.
Re:Clarification (Score:5, Insightful)
Re: (Score:2)
Re: (Score:1)
Yes, you'll have to do some work instead of posting to a blog all day.
Re:Clarification (Score:5, Funny)
Why wait 3 seconds?
Re: (Score:2, Informative)
Re: (Score:1)
Hey, my WordPress hosting is on DreamHost. There's no way that will take less than 3 seonds per iteration. So I'm safe from your DOS. Oh, wait...
Re: (Score:1)
Re: (Score:3)
Can't the administrator use the same hack to change the password again, regaining access?
Re: (Score:2)
Can't the administrator use the same hack to change the password again, regaining access?
For the same reason why this crack only locks out an administrator, rather than capturing the account; one would have to encrypt their new password using the same algorithm as the application.
Re: (Score:3, Informative)
> Using the special URL, the old password is removed and a new one generated in its place with no confirmation required.
While you're right in saying the attacker can't access the admin's account, the admin themselves also can't access it, because their password has already been reset to something else, and they'll have to get the new one. It seems more like a minor inconvenience to me, then a massive bug which will end the world, but still a flaw.
The admin still gets the password change notification, tho
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
it will cause a boat load of grief to the site's admins when someone automates a process for resetting passwords.
Fixed that for you :)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
RTFA? Did you RTFSummary? The point is that the password is reset but the reset doesn't get sent to the admin email as per usual. Yes, the attacker can't get the password, but the admin doesn't get it either.
So, you just need to reset the password again using normal means.
Re:Clarification (Score:4, Informative)
RTFA? Did you RTFSummary? The point is that the password is reset but the reset doesn't get sent to the admin email as per usual.
Except that's not actually what it says, and even if it was TFA states otherwise:
As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner.
The e-mail that doesn't get sent is the one asking the user to confirm they want to reset their password, since that step is bypassed by the exploit.
Re: (Score:2)
You're going to need admin accounts as long as you want to have different classes of users and have certain users manage some stuff.
Re: (Score:1)
Re: (Score:2)
so what do you do when you want to install an update? :_)
"return the system to a known state" :-)
My question is, how does he do backups, if no account has permission to access those system files that only root can access? /", and added himself to every group on the machine? /"?
Or has he done a "chmod g+rw -R
Or maybe "chmod a+wrx -R
Re: (Score:1)
Re: (Score:2)
Disabling the ability to login as root/administrator does not remove the account from the machine.
The kernel on a *nix machine still runs at the same privilege level, along with a bunch of system daemons.
Same with Windows. You can't log in as Administrator on an XP Home machine....until you boot in safe mode. But programs can still run with administrator privileges, even when the account forbids login.
In fact, completely removing the root/administrator account on a machine would probably render it non-boo
Re: (Score:2)
The kernel on a *nix machine still runs at the same privilege level, along with a bunch of system daemons.
No it doesn't. The kernel runs in ring 0 with no user account. When making a system call into the kernel, a classical *NIX machine will check whether the call is made by UID 0 (root) but the kernel itself is not running as the root user. On a more modern system, there are privilege elevation mechanisms that allow the kernel to perform privileged operations on behalf of other users, so you don't need the root user at all.
Re: (Score:2)
I didn't say the kernel ran as root. I said it runs at the same privilege level. Meaning, removing the root account will still leave any root exploit in the kernel just as open as it was before.
Re: (Score:3, Informative)
The kernel does not run at the same privilege level as root. Root is a user which the kernel allows to access (some) privileged services. Root programs run in ring 3 (on x86, unprivileged mode on other platforms), while the kernel runs in ring 0 (or privileged mode on non-x86 platforms). The kernel can access physical hardware directly. The root user can not, they can only request that the kernel access it on their behalf. On some UNIX systems there is a device node which allows a sufficiently-privileg
Re: (Score:2)
Ok....vagueness in the English language breaks conversation yet again.
When I said "The kernel runs at the same privilege level," you thought I meant the kernel ran at the same privilege level as root.
I meant the kernel runs at the same privilege level regardless of whether the root user exists or not.
Perhaps I should have continued my sentence, rather than implying that....
Re: (Score:2)
Full disclosure a day after discovery? (Score:4, Interesting)
Re: (Score:2)
Since updating Wordpress is just a matter of pushing a button on the administrative screen, even being lazy is little reason not to go ahead.
Re: (Score:2)
Except that new versions have become more memory-hungry, and any sysadmin worth his money will limit the amount of memory that a PHP script is allowed to take. If it is insufficient for the new version, the automatic upgrade will just fail silently. Not so good.
My copy of wordpress doesn't have this problem (Score:1, Interesting)
That's funny, my copy of Wordpress is not vulnerable to this issue. Oh wait, I tweaked things so that all of the logins and the like go over a separate, password-protected SSL connection. https://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]= just won't work :) Obviously this won't work if you let arbitrary users login to your wordpress account.
Re: (Score:2)
And how did you manage to get wordpress to not insist on redirecting everything to a single host?
That's why I stopped using Wordpress (Score:4, Insightful)
Re: (Score:2)
drupal
Re: (Score:2)
Radiant CMS [radiantcms.org]
Re: (Score:2)
Re: (Score:3, Insightful)
*laugh explosion* Ya, that's an awesome idea for making sure your app is secure. Remember that old rule about writing your own crypto? That still applies today to CMS webapps. Unless you have a *set* of friends that pentest webapps professionally, writing your own CMS is an absolutely terrible idea.
Re: (Score:2)
Securing a simple web app is mostly a matter of sanitizing your inputs (and sometimes the outputs as well). A good developer should be able to almost intuitively predict the weak points in an app and harden those. Sure, if you're just an average MCSE copy/pasting code from any random forum, you're asking to get owned, but if you understand what your data is doing and why, then it should be a natural part of your development process to identify what does and doesn't belong in your data structures, and ensu
Re: (Score:2)
... and yet contrary to your assumptions, it would seem that professional programmers get this wrong on a regular basis, at least according to the security mailing lists I'm on.
Trusting someone worthy of your trust is much lower stress not to mention lower effort than rolling your own every time you need an application.
Re: (Score:2)
Thank you, AC. It's nice to know some people can still tell the difference between the two.
One works for the money, the other is a developer.
Re: (Score:2)
"sanitizing inputs" is not a trivial task. Significant work has been done to break out of even the most sound sanitization and parameterization techniques, even the ones built into the various programming languages.
Almost no developers are aware of this research, and even if they do think about sanitization, they often end up just doing a simple regex.
Re: (Score:2)
If your blog app only reads from a database, and never writes to it, what needs securing? You can write other tools to write to the db.
Re: (Score:1)
Re: (Score:1)
Re:That's why I stopped using Wordpress (Score:4, Insightful)
blogspot
Unless you have a team of developers and pentesters constantly maintaining your blog, you are better off getting it hosted somehwere else. Any given blog instance that is not properly maintained is only going to remain secure for about 6 months or so. If you, or you and a few people, or even a small company just want a simple blog to post stuff on, and you don't want to hire a staff of infosec monkeys, blogspot is definitely the way to go. The code is maintained by google, and data is redundantly backed up for you for free.
Re: (Score:2)
Re: (Score:1)
You deserve that one. If you can't access arbitrary locations on the internet, that's your own fault for sucking. What's the alternative, I should always copy-paste a complete website rather than sending a link?
Re: (Score:2)
Re: (Score:1)
If your ISP isn't giving you internet access, unfiltered, then that's your fault for not getting a better one. Likewise for your employer.
The alternative is to use websites that everyone can access
Which I'm supposed to figure out how? I should hack into all my friends' networks and read their blocklists before sending them anything?
Re: (Score:2)
I have a hard time understanding the concept of a site being blocked.
If a website that you are supposed to be able to see is blocked, then complain, move, or bounce past the blockage.
It's not that big of a deal (Score:2)
I run a site on Wordpress and managing the software updates has never been a big deal for me. I have shell access at my hosting provider, so I initially just installed Wordpress using CVS. Every time they rolled out a new bugfix, I just ran a little shell script like: "update "
With recent versions of Wordpress, though, you don't even need to do that. When a new update is available, an alert appears on your admin dashboard. From there, you can actually click a button and have the system download the update a
Re: (Score:1)
Try Movable Type. It's maybe not what I'd really call "lightweight", but it isn't huge either.
Re: (Score:2)
I use blosxom [sourceforge.net], which is extremely lightweight. The only way to get lighter is to have a static blog. It's only about 800 lines of Perl in a single script, so anyone who knows a little programming can easily become intimate with it. Many people who use it, including me, slowly modify it over time [plover.com] to fit our needs, molding it like a piece of putty. Its small size, with its worse is better [plover.com] tradeoffs, makes it pretty robust in terms of security, because there isn't any complexity in which to have vulnerabilitie
Re: (Score:2)
To reply again with another tool,
There's a neat blog generator called Thingamablog [sourceforge.net], which generates a static blog, and therefore has no vulnerabilities itself. Write entries offline, generate the static HTML, then sync that up to the server. Because there is no dynamic content, it works for hosts that only serve static content (like on Freenet, which can only "host" static pages) and minimizes the work done by the server. It's still pretty feature rich, with categories, and good navigation.
The downside lack
Re: (Score:1)
Thanks (Score:1)
Re: (Score:3, Funny)
Now to do the other sites later tonight.
What, by chance, is the web addresses for your other sites.
No particular reason why I'm wondering. Just...um...want to read your blogs...
Re: (Score:1)
Re: (Score:1)
Code is Poetry (Score:4, Interesting)
If Code is Poetry then Wordpress is some 15 year old's notebook scribblings on angst, Twilight and Dashboard Confessional.
If you're looking for alternatives that don't have gaping security issues with seemingly every release, check out Serendipity [s9y.org].
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
This made me think of Wario Ware: Smooth Moves explaining the various forms.
PHP is doggerel (Score:2)
It seems that most PHP apps have this problem because they encourage a "macro script" mentality.
Perl FTW.
WordPress is Awesome (Score:1, Informative)
*opens dashboard, presses "Upgrade to 2.8.4" button*
Fixed. :D
Re:WordPress is Awesome (Score:4, Insightful)
*opens dashboard, presses "Upgrade to 2.8.4" button*
Fixed. :D
Not sure why you got modded down (probably just the way you put it). Upgrading Wordpress is trivially easy.
Exploits happen, and this is a pretty minor one (just an annoyance, not user permission escalation, admin rights etc). They got a fix out quick and it's easy enough to apply.
Don't get it (Score:1)
I'm not a PHP expert, but why does this work?
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if ( empty( $key ) )
return new WP_Error('invalid_key', __('Invalid key'));
$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE
user_activation_key = %s", $key));
if ( empty( $user ) )
Re:Don't get it (Score:4, Informative)
There is a discussion about the vulnerability on StackOverflow [stackoverflow.com]
Bah most web programs have that bug (Score:2)
for the password reset. You enter the Admin's user ID and click on a "Forgot password" button or link and it emails a new password to the email the Admin uses.
Some software like Scoop has it and the new password is only good for a few days or so, in case the user or admin didn't request a new password and it allows the old password to work until the new password is used. Only the new password is emailed to the email address on file.
Now if it showed the new password on the web page, that would be locking out
PHP is to blame (Score:3, Informative)
How many of you PHP developers out there knew that? I didn't. And I had to dig quite a bit to find a reference to this behaviour in the docs.
So, incoming stuff from the URL or the POST data are no longer strings all the time. Can they magically become other things than strings and arrays as well? Maybe not now, but what if some PHP developer thinks up another "nifty" feature _after_ I read the docs; how then am I supposed to protect my application in the future? Do I need to re-read the docs every time I upgrade PHP?
And is there a way to turn this "we know better than you what you need"-behaviour off?
I'm sick of seing framework developers add "nifty" features that you have to know about in order to write secure code. It's not only PHP, but also several highly popular Java frameworks that I work with these days. Some of them make it quite easy to write to object fields that are normally out of reach of the input fields in a form.
I want a framework that makes it impossible to make mistakes, and where you have to _enable_ potentially dangerous features when you _know_ you need them, rather than _disable_ potentially dangerous features most people don't know about (or use).
Re: (Score:2)
http://example.com/reset.php?key=&key=
If it had been that, that would (to my mind) be more reasonable for it ($_GET['key]) to return an array, but yeah, the square brackets = an array is totally new to me.
PHP seems to be full of far far too much "helpful" crap like this!
Re: (Score:1)
Stupidity (Score:3, Insightful)
I wonder why somebody would code that part the way they did it. As far as I understand it, they are trying to validate code by blacklisting instead of whitelisting:
(from http://core.trac.wordpress.org/changeset/11798 [wordpress.org])
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if ( empty( $key ) )
die();
If you expect a hash you generated yourself, why don't you test if it preg_matches the spec you used to generate it in the first place? (/^[a-zA-Z0-9]{20}$/ in this case)
Well that and being naive enough to expect $_GET["key"] to always return a string....
Re: (Score:3, Informative)
On the other hand, this isn't exactly PHP's fault (or MySQL's, for that matter). The query:
They're selecting a row (the user) by a column (user_activation_key) that can be blank. Not NULL but literally an empty string. Bad.