Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica) [LWN.net]

Ars Technica reports on a recently discovered bug in WordPress 3 sites that could be used to launch malicious script-based attacks on site visitors’ browsers. "The vulnerability, discovered by Jouko Pynnonen of Klikki Oy, allows an attacker to craft a comment on a blog post that includes malicious JavaScript code. On sites that allow comments without authentication—the default setting for WordPress—this could allow anyone to post malicious scripts within comments that could target site visitors or administrators. A proof of concept attack developed by Klikki Oy was able to hijack a WordPress site administrator’s session and create a new WordPress administrative account with a known password, change the current administrative password, and launch malicious PHP code on the server. That means an attacker could essentially lock the existing site administrator out and hijack the WordPress installation for malicious purposes." WordPress 4.0 is not vulnerable to the attack.

to post comments

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 18:18 UTC (Tue) by drag (guest, #31333) [Link] (17 responses)

This is why I never let anything I run for personal reasons be exposed on the internet. I always try to stick behind some reverse proxy with ssl-only httpauth or make vpn-only or something like that.

I figure having complex applications exposed on the internet of any type is a mistake unless you have a staff of people online to monitor and support them. Even for something as stupid as a personal blog.

Which makes me feel bad for people trying to setup 'OwnCloud' or other similar applications for their smart phones. Seems like it's just setting up people to fail.

For personal websites and services like that it should never expose the actual application to the internet, but instead focus on doing things like automating the generation of static html web pages or set up services that require a simple VPN to access (for smart phones, sync, and such).

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 18:27 UTC (Tue) by drag (guest, #31333) [Link]

(and by 'stupid' I don't mean that it's idiotic to run a personal blog... I just mean that it should be so simple and easy at this point that it should require no thought or effort at all)

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 19:02 UTC (Tue) by iabervon (subscriber, #722) [Link] (15 responses)

This hole is about attacker-provided data stored on the vulnerable site subverting the admin's browser to perform authorized but unintended actions. This class of hole could affect, for example, a vpn-only private site with a feed aggregation feature.

I guess the potential for havoc is reduced somewhat by the fact that the attacker can create an admin account but still can't use it interactively.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 19:43 UTC (Tue) by drag (guest, #31333) [Link] (2 responses)

> This hole is about attacker-provided data stored on the vulnerable site subverting the admin's browser to perform authorized but unintended actions.

Yes. Classic problem. User input is not properly validated by the website so you end up hosting something malicious.

> I guess the potential for havoc is reduced somewhat by the fact that the attacker can create an admin account but still can't use it interactively.

Well in the article states that you can use the admin access you can gain through this attack to inject php code on the server, which then will lead to shell access in most common hosting situations. Once they get shell then the probability of gaining root is extremely high even if the web server is setup to drop privileges.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 20:30 UTC (Tue) by iabervon (subscriber, #722) [Link] (1 responses)

I was trying to think of situations where the attacker doesn't have to be a user on the vulnerable site (in order to get through your only-over-vpn or ssl auth defense). I could imagine a site you might run that only you can sync your phone to and only you can browse that data, but it could easily show id3v2 tags in your mp3s, and fail to strip the HTML in them, so that looking at a malicious mp3 might induce you to reconfigure the site. The fact that the attacker can't communicate at all with the site wouldn't save you in this situation.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 22:41 UTC (Tue) by drag (guest, #31333) [Link]

> I was trying to think of situations where the attacker doesn't have to be a user on the vulnerable site (in order to get through your only-over-vpn or ssl auth defense).

Oh. I see.

> I could imagine a site you might run that only you can sync your phone to and only you can browse that data, but it could easily show id3v2 tags in your mp3s, and fail to strip the HTML in them, so that looking at a malicious mp3 might induce you to reconfigure the site.

Well.. In this particular vulnerability you would still be vulnerable if in combination with the improper input validation the wordpress site created forms in a predictable manner, thus opening you up to a cross site scripting attack.

IIRC one of the more unfortunate 'features' of http auth is that if your browser is logged into a particular website then that means everything that your browser does can potentially access that website. So any client side scripting going on can then just 'hijack' a existing ssl/http-auth session.

So, obviously this is not fool proof 100% protection.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 25, 2014 23:13 UTC (Tue) by ballombe (subscriber, #9523) [Link] (11 responses)

But this is the point:
Does 86% of wordpress users need that feature ?
Why is there even an admin account ?

If the security of your website depend on the security of your browser, then something is wrong.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 0:04 UTC (Wed) by bmur (guest, #52954) [Link] (6 responses)

Asking if wordpress needs an admin account is like asking if linux needs a root user. I'm not sure what your point is.

In wordpress it's possible to setup author & editor level accounts for posting if you wish.

To your other comment about browser security. It's pretty common for client/server apps that security of the client plays a large role in security to the server.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 11:33 UTC (Wed) by oldtomas (guest, #72579) [Link] (2 responses)

> To your other comment about browser security. It's pretty common for client/server apps that security of the client plays a large role in security to the server.

But this is exactly the problem. The very idea that a "document" can take total control of your document viewer (or put in another way: the idea that I have an application which downloads and executes random content from the Intarwebs) should stick out as a "very bad idea" -- this painful experience was made long time ago (remember Word macro viruses?).

A site (and especially the admin endpoint of a site) should offer basic usability without any client-side scripting whatsoever, so that a user (and especially an admin) should be able to disable client-side scripting if she choses to do so.

With HTML5 this ship is sailing away quickly. But any other fixes (server-side XSS protections, sandboxing in the clients, selective script execution à la Noscript) are bound to show cracks at ever-changing unexpected places.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 17:32 UTC (Wed) by raven667 (subscriber, #5198) [Link] (1 responses)

I think that web sites have stopped being "documents" and are in fact client/server applications for a long time now, like since Netscape 2, that ship has sailed and sent postcards from the other shore. The fact that the web is primarily an application delivery platform, with document viewing being a built-in application, was a major goal from the outset in the 1990s and is why vendors like MS were so scared, that most things would move into web apps (like it has done now) and they would be left without any leverage in the market (which they kind of don't have now).

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Dec 11, 2014 2:54 UTC (Thu) by Baylink (guest, #755) [Link]

Certainly, but I believe you've misunderstood the assertion.

It is not that websites shouldn't *be* code.

It's that they shouldn't *run* code provided to them through their public user interfaces (probably "whether authenticated or not").

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 15:38 UTC (Wed) by ballombe (subscriber, #9523) [Link] (1 responses)

> Asking if wordpress needs an admin account is like asking if linux needs a root user. I'm not sure what your point is.

You should be able to perform admin task without a web browser.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 23:22 UTC (Wed) by dlang (guest, #313) [Link]

> You should be able to perform admin task without a web browser.

Ok, so you are saying that the wordpress users need to be taught how to ssh into a server to make changes to their config.

Can you see how this could be a problem for windows users?

Can you see how allowing $randon_internet_user shell access on a shared server would be even more dangerous than them using a browser to administer their site?

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 23:48 UTC (Wed) by iabervon (subscriber, #722) [Link]

Actually, WordPress doesn't have the equivalent of a root account; instead, some users simply have admin privileges while they ordinarily use the site. This hole wouldn't have been possible if you couldn't simultaneously have the ability to read posts and the authorization to do administrative tasks. (Or, rather, it would have been limited to author/editor-type impact.)

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Nov 26, 2014 4:44 UTC (Wed) by mathstuf (subscriber, #69389) [Link]

I think it is more that 86% of WP sites are on version 3 rather than 4.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Dec 5, 2014 9:26 UTC (Fri) by Seegras (guest, #20463) [Link] (2 responses)

> Does 86% of wordpress users need that feature ?

I think commenting on blogs is rather superfluous. You're supposed to have your own blog and comment on others blogs there, via pingback. Kind of a distributed facebook *gosh*.

However, this doesn't really solve the whole problem, since those pingbacks could also be a security issue...

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Dec 5, 2014 9:53 UTC (Fri) by tao (subscriber, #17563) [Link] (1 responses)

Pingbacks as a means of commenting suck. It's one thing if you write an opinion-piece and someone else writes a rebuttal, but if someone writes, say, a technical article and someone wants to ask a question you really want to have support for comments.

Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

Posted Dec 5, 2014 16:54 UTC (Fri) by flussence (guest, #85566) [Link]

I didn't even know that was what pingbacks *were*; they have the same context-oblivious "click me!" appearance as the spam that usually appears alongside them, so that's what I've always interpreted them as.

Holding a real conversation that way sounds like using a half-duplex phone that requires a hangup/reconnect to switch direction.