6 ms·

Tell HN : Wordpress.com exploit

110 points by sandaru1 17y ago

There seems to be a very serious wordpress.com exploit which allows 3rd party sites/domains to gather a hash code which can be used to login to an user's account. Here is how to reproduce, 1. Login to wordpress.com 2. Take a look at this page : http://www.sandaru1.com/wordpress_test.html (This page is just showing the hashcode/url, I'm not saving any hashcodes) 3. Open another browser (in an attacker's case, his/her browser) and paste the URL shown in the page 4. Goto wordpress.com on the new browser and you are logged in The exploit itself seems to be too simple. Am I missing something here or is this a serious bug? P.S - I emailed both Automattic support and Matt Mullenweg. I didn't get any response back.

bittersweet 17y ago
How did you contact them by the way? I've been looking for ways to get in touch with them with a security related question but can't find anything, which doesn't look well on their part, especially with their security record.
- lloydbudd 17y ago
  Does seem a little tricky to find. security at wordpress.org Listed at http://core.trac.wordpress.org/ http://core.trac.wordpress.org/ Members of WordPress.com are on that mailing list as well. http://en.support.wordpress.com/contact/ http://en.support.wordpress.com/contact/ if anything is definitely WordPress.com specific, but I suggest always including security at wordpress org, because there may be another permutation to the attack.
- sandaru1 17y ago
  Indeed, they don't have a method for reporting security exploits. Wordpress Blogging Platform has one, but this issue is only limited to wordpress.com. I believe it has something to do with intensedebate.com First I sent a email to matt(http://ma.tt/contact/ http://ma.tt/contact/). Then, I used the Automattic contact form(http://automattic.com/contact/ http://automattic.com/contact/)
jorisvoorn 17y ago
Is there any way, that it's fixed already? I've got the message "Invalid key." while I was trying to go to that URL in incognito/private mode OR in another browser
davidu 17y ago
I sent this News.YC page over to Barry over at Wordpress who runs ops. FWIW, I tested this and it does seem to work.
chanux 17y ago
OK Here's what I experienced. First I loged in WP, got the URL from sandaru1s page. I logged out and tried the URL. And yes it worked. Then I deleted all wordpress cookies and tried again. Then I got the response as invalid key. Again logged in and fetched new URL. This time I got a 502 with the URL. Refreshing took me 'invalid key' message (didn't touch cookies). Update: Sandaru1s page doesn't provide a url anymore (for me). May be it's fixed? Update2: Going to Sandaru1s page once logged in to WP now logs me out.
jfarmer 17y ago
Works for me. :|
- ErrantX 17y ago
  yep, me too. ouch. EDIT: is this tested on different IP addressess? I only have the one IP address in this office to try it on - I could see it being IP secured.
  - sandaru1 17y ago
    I tested it using two different IP addresses about two days ago. Exploit is still there. Even if there are IP restrictions, it might be dangerous.
ronnier 17y ago
I haven't tested this, but if it truly works, one just needs to include <script src="http://wordpress.com/remote-login.php?action=jsonp&jsonp=get_hash></script&#62 http://wordpress.com/remote-login.php?action=jsonp&jsonp...; in a page and harvest hashes of its visitors?
- sandaru1 17y ago
  Yes. Just a simple JSONP API call.
  - stanleydrew 17y ago
    Is there wordpress JSONP API documentation anywhere? A couple of Google searches didn't turn anything up.
    - bittersweet 17y ago
      I checked out the Wordpress source just now and no mention of remote-login. I don't know if wordpress.com itself has any API documentation.
      - ErrantX 17y ago
        It looks like they have an xmlrpc.php file - so you could try using that.
- deleted 17y ago
  [deleted]
phreanix 17y ago
Shoot, works for me. WTF. Edit: Post this exploit here: http://en.forums.wordpress.com/forum/support http://en.forums.wordpress.com/forum/support Of course, you'd have to be logged in first. =p
- sev 17y ago
  I wouldn't post it there. I would contact them privately. We don't want any random stroller of the wordpress forums to get a hold of this.
  - vijaydev 17y ago
    but you would let a random stroller of hn get hold of this??
    - sev 17y ago
      That ship has already sailed. The more places it's posted, the worse it is.
  - SeamusBrady 17y ago
    Interesting that you consider HN a hangout for good guys only. A compliment!
    - sev 17y ago
      I never said I consider HN a hangout for good guys only. "Bad guys" are constantly looking for exploits in wordpress though, considering it's horrible track record. Therefore it's much more likely that one of them would go to the wordpress forums as opposed to here. Plus, it's already posted here, my point was to not make it any more public than it already has become.
ErrantX 17y ago
ok, I got a friend to copy/paste my url into their browser over IM (currently in the wrong office to access different IP's) and it didn't work (I am assuming they did it right, etc.). So this looks like it could be a local exploit only (doesn't make it any less exploitable)
- teye 17y ago
  I get "Invalid key." locally.
  - ErrantX 17y ago
    I get that if you try the same hash twice. Go to wordpress.com and see if it logged you in.
jcsalterego 17y ago
Just curious, how long did you wait for a response before doing the whole full disclosure thing? :-\
- sandaru1 17y ago
  About 2/3 days
  - growt 17y ago
    like in 2 or 3 days, or like 0.666 days? :)
    - sandaru1 17y ago
      2 or 3 days
      - vinhboy 17y ago
        Couple of weeks ago I found a WP related hack on MT, had the same dilemma. I still wonder what the proper protocol is.
        hew 17y ago
        For core issues (WordPress.org), send an email with the details to: security@wordpress.org For WordPress.com specific issues, you can use the general support form: http://en.support.wordpress.com/contact/ http://en.support.wordpress.com/contact/
        tptacek 17y ago
        General support form for inbound security findings? Check! Word "security" appears nowhere on the front page? Check! Word "security" appears nowhere on the support page? Check! Guys. Please. Fix this! It's not like it's unlikely that someone is going to want to report things to you. You need: * A security page... * ... with a PGP key ... * ... and an email contact ... * ... of someone who will write back immediately ... * ... who knows what a security vulnerability is. That's all you need to do. You haven't done that yet. You come close on Wordpress.org, but not close enough. You are asking people to wait only 2-3 days before writing scary-sounding blog posts. This is too easy not to fix. While you're at it, earn some extra credit: * Reply with special vulnerability IDs so that reporters think their report isn't waiting in line after bugs in your online help system. Whether it actually or isn't isn't even a problem you need to solve yet. * Thank researchers privately instead of ignoring them. * Give them a phone number to call back and get status on their report. You're a company. You can scale this. * Be like Google, Apple, and Microsoft and keep a thank-you page for people who have disclosed problems "responsibly" to you.
lloydbudd 17y ago
WordPress.com team is investigating the issue. They have disabled the vector while they continue to investigate.
- stanleydrew 17y ago
  Do you work on the Wordpress.com team? No info in your profile.
  - lloydbudd 17y ago
    Yes. Updated my profile, but don't believe what you read on the interwebs ;-)
    - anotherjesse 17y ago
      Ha! Funny as always. Too bad there is no way of verifying you are really lloyd. Seems like we could come up with something - even if it only works for techies.
      - savant 17y ago
        You mean like foaf+ssl?
- gorm 17y ago
  Is it a general bug in WordPress MU or just an issue with wordpress.com?
  - lloydbudd 17y ago
    Specific to WordPress.com. Not a general bug in WordPress or WordPress MU.
oscardelben 17y ago
Situations like this are why I've chosen to stay away from wordpress.
- jqueryin 17y ago
  If this was your personal site or a custom CMS, odds are there wouldn't be enough community support to report bugs (or exploits) like this one. You'd simply go about your business thinking your site was secure.
  - idlewords 17y ago
    If it was my personal site, I would serve flat files. The fundamental problem with Wordpress is a design decision to have live code serving what could easily be static content. If there is no code, there's no exploit.
  - wildmXranat 17y ago
    I know he didn't state which direction he chose, but assuming that he's incompetent is pretty bad on your part. I remember few months ago, wordpress had a bug where an attacker could keep on resetting administrators account password. He might actually have a point
    - jqueryin 17y ago
      Incompetence has nothing to do with it. It's just all too common that we overlook something in our code. All software inherently has bugs as no developer is perfect. There's alot to be said about having millions of prying eyes nitpicking your source code. I'd much assume millions of people critiqued my code as opposed to none at all.
      - shrughes 17y ago
        Have you looked at the code? When I started using WordPress on my personal site, people warned me not to look behind the curtains. It seems pretty notorious for being a mess.
stanleydrew 17y ago
Based on a comment below it seems this doesn't affect local installs of Wordpress since the source doesn't include remote-login.php.
elptacek 17y ago
I experienced something similar a while back when I tarred up a live instance of a wordpress installation and fired it up on my local machine. To deal with redirects, I changed /etc/hosts to resolve the live domain to the local IP. While I was working on the local copy, I would from time to time need to refer to the live instance. To do this, I'd comment out the entry in /etc/hosts and browse to the live site. At some point, I noticed that the theme for the live site had been set back to the default. When I investigated, it turned out that my session credentials for the local instance were honored by the live (remote) site. The odd thing about this is that I hadn't been given the admin password for the remote-live wordpress instance. I had manually modified the database to change the admin password in order to work on the local instance before firing it up. I never did look into how wordpress created or verified session credentials, but it did seem like something odd was going on, there.

110 points by sandaru1 17y ago

bittersweet 17y ago

How did you contact them by the way? I've been looking for ways to get in touch with them with a security related question but can't find anything, which doesn't look well on their part, especially with their security record.

lloydbudd 17y ago
Does seem a little tricky to find. security at wordpress.org Listed at http://core.trac.wordpress.org/ http://core.trac.wordpress.org/ Members of WordPress.com are on that mailing list as well. http://en.support.wordpress.com/contact/ http://en.support.wordpress.com/contact/ if anything is definitely WordPress.com specific, but I suggest always including security at wordpress org, because there may be another permutation to the attack.
sandaru1 17y ago
Indeed, they don't have a method for reporting security exploits. Wordpress Blogging Platform has one, but this issue is only limited to wordpress.com. I believe it has something to do with intensedebate.com First I sent a email to matt(http://ma.tt/contact/ http://ma.tt/contact/). Then, I used the Automattic contact form(http://automattic.com/contact/ http://automattic.com/contact/)

jorisvoorn 17y ago

Is there any way, that it's fixed already? I've got the message "Invalid key." while I was trying to go to that URL in incognito/private mode OR in another browser

davidu 17y ago

I sent this News.YC page over to Barry over at Wordpress who runs ops. FWIW, I tested this and it does seem to work.

chanux 17y ago

OK Here's what I experienced. First I loged in WP, got the URL from sandaru1s page. I logged out and tried the URL. And yes it worked. Then I deleted all wordpress cookies and tried again. Then I got the response as invalid key. Again logged in and fetched new URL. This time I got a 502 with the URL. Refreshing took me 'invalid key' message (didn't touch cookies). Update: Sandaru1s page doesn't provide a url anymore (for me). May be it's fixed? Update2: Going to Sandaru1s page once logged in to WP now logs me out.

jfarmer 17y ago

Works for me. :|

ErrantX 17y ago
yep, me too. ouch. EDIT: is this tested on different IP addressess? I only have the one IP address in this office to try it on - I could see it being IP secured.
- sandaru1 17y ago
  I tested it using two different IP addresses about two days ago. Exploit is still there. Even if there are IP restrictions, it might be dangerous.

ronnier 17y ago

I haven't tested this, but if it truly works, one just needs to include <script src="http://wordpress.com/remote-login.php?action=jsonp&jsonp=get_hash></script&#62 http://wordpress.com/remote-login.php?action=jsonp&jsonp...; in a page and harvest hashes of its visitors?

sandaru1 17y ago
Yes. Just a simple JSONP API call.
- stanleydrew 17y ago
  Is there wordpress JSONP API documentation anywhere? A couple of Google searches didn't turn anything up.
  - bittersweet 17y ago
    I checked out the Wordpress source just now and no mention of remote-login. I don't know if wordpress.com itself has any API documentation.
    - ErrantX 17y ago
      It looks like they have an xmlrpc.php file - so you could try using that.
deleted 17y ago
[deleted]

phreanix 17y ago

Shoot, works for me. WTF. Edit: Post this exploit here: http://en.forums.wordpress.com/forum/support http://en.forums.wordpress.com/forum/support Of course, you'd have to be logged in first. =p

sev 17y ago
I wouldn't post it there. I would contact them privately. We don't want any random stroller of the wordpress forums to get a hold of this.
- vijaydev 17y ago
  but you would let a random stroller of hn get hold of this??
  - sev 17y ago
    That ship has already sailed. The more places it's posted, the worse it is.
- SeamusBrady 17y ago
  Interesting that you consider HN a hangout for good guys only. A compliment!
  - sev 17y ago
    I never said I consider HN a hangout for good guys only. "Bad guys" are constantly looking for exploits in wordpress though, considering it's horrible track record. Therefore it's much more likely that one of them would go to the wordpress forums as opposed to here. Plus, it's already posted here, my point was to not make it any more public than it already has become.

ErrantX 17y ago

ok, I got a friend to copy/paste my url into their browser over IM (currently in the wrong office to access different IP's) and it didn't work (I am assuming they did it right, etc.). So this looks like it could be a local exploit only (doesn't make it any less exploitable)

teye 17y ago
I get "Invalid key." locally.
- ErrantX 17y ago
  I get that if you try the same hash twice. Go to wordpress.com and see if it logged you in.

jcsalterego 17y ago

Just curious, how long did you wait for a response before doing the whole full disclosure thing? :-\

sandaru1 17y ago
About 2/3 days
- growt 17y ago
  like in 2 or 3 days, or like 0.666 days? :)
  - sandaru1 17y ago
    2 or 3 days
    - vinhboy 17y ago
      Couple of weeks ago I found a WP related hack on MT, had the same dilemma. I still wonder what the proper protocol is.
      - hew 17y ago
        For core issues (WordPress.org), send an email with the details to: security@wordpress.org For WordPress.com specific issues, you can use the general support form: http://en.support.wordpress.com/contact/ http://en.support.wordpress.com/contact/
        tptacek 17y ago
        General support form for inbound security findings? Check! Word "security" appears nowhere on the front page? Check! Word "security" appears nowhere on the support page? Check! Guys. Please. Fix this! It's not like it's unlikely that someone is going to want to report things to you. You need: * A security page... * ... with a PGP key ... * ... and an email contact ... * ... of someone who will write back immediately ... * ... who knows what a security vulnerability is. That's all you need to do. You haven't done that yet. You come close on Wordpress.org, but not close enough. You are asking people to wait only 2-3 days before writing scary-sounding blog posts. This is too easy not to fix. While you're at it, earn some extra credit: * Reply with special vulnerability IDs so that reporters think their report isn't waiting in line after bugs in your online help system. Whether it actually or isn't isn't even a problem you need to solve yet. * Thank researchers privately instead of ignoring them. * Give them a phone number to call back and get status on their report. You're a company. You can scale this. * Be like Google, Apple, and Microsoft and keep a thank-you page for people who have disclosed problems "responsibly" to you.

lloydbudd 17y ago

WordPress.com team is investigating the issue. They have disabled the vector while they continue to investigate.

stanleydrew 17y ago
Do you work on the Wordpress.com team? No info in your profile.
- lloydbudd 17y ago
  Yes. Updated my profile, but don't believe what you read on the interwebs ;-)
  - anotherjesse 17y ago
    Ha! Funny as always. Too bad there is no way of verifying you are really lloyd. Seems like we could come up with something - even if it only works for techies.
    - savant 17y ago
      You mean like foaf+ssl?
gorm 17y ago
Is it a general bug in WordPress MU or just an issue with wordpress.com?
- lloydbudd 17y ago
  Specific to WordPress.com. Not a general bug in WordPress or WordPress MU.

oscardelben 17y ago

Situations like this are why I've chosen to stay away from wordpress.

jqueryin 17y ago
If this was your personal site or a custom CMS, odds are there wouldn't be enough community support to report bugs (or exploits) like this one. You'd simply go about your business thinking your site was secure.
- idlewords 17y ago
  If it was my personal site, I would serve flat files. The fundamental problem with Wordpress is a design decision to have live code serving what could easily be static content. If there is no code, there's no exploit.
- wildmXranat 17y ago
  I know he didn't state which direction he chose, but assuming that he's incompetent is pretty bad on your part. I remember few months ago, wordpress had a bug where an attacker could keep on resetting administrators account password. He might actually have a point
  - jqueryin 17y ago
    Incompetence has nothing to do with it. It's just all too common that we overlook something in our code. All software inherently has bugs as no developer is perfect. There's alot to be said about having millions of prying eyes nitpicking your source code. I'd much assume millions of people critiqued my code as opposed to none at all.
    - shrughes 17y ago
      Have you looked at the code? When I started using WordPress on my personal site, people warned me not to look behind the curtains. It seems pretty notorious for being a mess.

stanleydrew 17y ago

Based on a comment below it seems this doesn't affect local installs of Wordpress since the source doesn't include remote-login.php.

elptacek 17y ago

I experienced something similar a while back when I tarred up a live instance of a wordpress installation and fired it up on my local machine. To deal with redirects, I changed /etc/hosts to resolve the live domain to the local IP. While I was working on the local copy, I would from time to time need to refer to the live instance. To do this, I'd comment out the entry in /etc/hosts and browse to the live site. At some point, I noticed that the theme for the live site had been set back to the default. When I investigated, it turned out that my session credentials for the local instance were honored by the live (remote) site. The odd thing about this is that I hadn't been given the admin password for the remote-live wordpress instance. I had manually modified the database to change the admin password in order to work on the local instance before firing it up. I never did look into how wordpress created or verified session credentials, but it did seem like something odd was going on, there.