Exploit-DB #9110
Description: WordPress Core / MU / Plugins - '/admin.php' Privileges Unchecked / Multiple Information Disclosures
Type: webapps
Platform: php
Date: 2009-07-10
Author: Core Security

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

      Core Security Technologies - CoreLabs Advisory
           http://www.coresecurity.com/corelabs/

WordPress Privileges Unchecked in admin.php and Multiple Information
Disclosures



1. *Advisory Information*

Title: WordPress Privileges Unchecked in admin.php and Multiple
Information Disclosures
Advisory ID: CORE-2009-0515
Advisory URL:
http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked
Date published: 2009-07-08
Date of last update: 2009-07-08
Vendors contacted: WordPress
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Local file include, Privileges unchecked, Cross site scripting
(XSS), Information disclosure
Remotely Exploitable: Yes
Locally Exploitable: No
Bugtraq ID: 35581, 35584
CVE Name: CVE-2009-2334, CVE-2009-2335, CVE-2009-2336


3. *Vulnerability Description*

WordPress is a web application written in PHP that allows the easy
installation of a flexible weblog on any computer connected to the
Internet. WordPress 2.7 reached more than 6 million downloads during
June 2009 [9].

A vulnerability was found in the way that WordPress handles some URL
requests. This results in unprivileged users viewing the content of
plugins configuration pages, and also in some plugins modifying plugin
options and injecting JavaScript code. Arbitrary native code may be run
by a malicious attacker if the blog administrator runs injected
JavasScript code that edits blog PHP code. Many WordPress-powered blogs,
hosted outside 'wordpress.com', allow any person to create unprivileged
users called subscribers. Other sensitive username information
disclosures were found in WordPress.


4. *Vulnerable packages*

   . WordPress 2.8 and previous
   . WordPress MU 2.7.1 and previous, used in WordPress.com


5. *Non-vulnerable packages*

   . WordPress 2.8.1
   . WordPress MU 2.8.1, used in WordPress.com


6. *Vendor Information, Solutions and Workarounds*

Mitigation for the Privileges Unchecked vulnerability (suggested by Core
Security): this vulnerability may be mitigated by controlling access to
files inside the 'wp-admin' folder. Access can be prohibited by using
Apache access control mechanism ('.htaccess' file), see guideline for
more information [11].


7. *Credits*

These vulnerabilities were discovered and researched by Fernando
Arnaboldi and JosÃ© Orlicki from Core Security Technologies. Further
research was made by Jose Orlicki from Core Security Technologies.


8. *Technical Description / Proof of Concept Code*


8.1. *Introduction*

In the last few years several security bugs were found in WordPress
[1][2]. During 2008, the big amount of bugs reported by researchers lead
to exploitation by blog spammers [3]. During 2009, a new round of
attacks has appeared and security researchers are reporting new bugs or
wrongly fixed previously-reported bugs [4][5]. A path traversal in local
files included by 'admin.php' has been fixed [6][7] but, in our case, we
report that administrative privileges are still unchecked when accessing
any PHP file inside a plugin folder.


8.2. *Access Control Roles*

WordPress has a privilege model where any user has an assigned role [8].
Regarding plugins only users characterized by the role Administrator can
activate plugins. Notice that only the blog hosting owner can add new
plugins because these must by copied inside the host filesystem. The
roles Editor, Author or Subscriber (the latter has the least privileges)
cannot activate plugins, edit plugins, update plugins nor delete plugins
installed by an Administrator. Besides that, the configuration of
specific plugins is a grey area because there is no distinguished
capability assigned [8].

Also due to cross-site scripting vulnerabilities inside plugins options
(something very common), non-administrative users reconfiguring plugins
may inject persistent JavaScript code. Possibly arbitrary native code
can be executed by the attacker if the blog administrator runs injected
JavasScript code that injects PHP code. It is important to observe that
many WordPress-powered blogs are configured to allow any blog visitor to
create a Subscriber user without confirmation from the Administrator
role inside the following URL, although by default the Administrator
role must create these new users.

/-----------

http://[some_wordpress_blog]/wp-login.php?action=register
- -----------/

 This can be modified by the administrator in 'Membership/Anyone can
register'.

/-----------

http://[some_wordpress_blog]/wp-admin/options-general.php
- -----------/




8.3. *Privileges Unchecked in admin.php?page= Plugin Local File Includes
(CVE-2009-2334, BID 35581)*

No privileges are checked on WordPress plugins configuration PHP modules
using parameter 'page' when we replace 'options-general.php' with
'admin.php'. The same thing happens when replacing other modules such as
'plugins.php' with 'admin.php'. Basic information disclosure is done
this way. For example, with the following URL a user with no privileges
can see the configuration of plugin Collapsing Archives, if installed.

/-----------

http://[some_wordpress_blog]/wp-admin/admin.php?page=/collapsing-archives/options.txt
- -----------/

 Instead of the following allowed URL.

/-----------

http://[some_wordpress_blog]/wp-admin/options-general.php?page=collapsing-archives/options.txt
- -----------/

 Another example of this information disclosure is shown on Akismet, a
plugin shipped by default with WordPress.

/-----------

http://[some_wordpress_blog]/wp-admin/admin.php?page=akismet/readme.txt
- -----------/

 All plugins we have tested are vulnerable to this kind of information
disclosure, but in many of them the PHP files accessed just crashed. On
the other hand, for example, with capability 'impor