Wordpress - Broken Access Control
By Michael Brooks
Vulnerability:Broken Access Control
Homepage:http://wordpress.org/download
Software: Wordpress
Version affected:2.3.1 (Latest at the time of writing)
The impact of the flaw is that an attacker can read posts while they are still
drafts. This is an ability that only the administrator should have. Imagine a
stranger being able to read the news before it is published. Or perhaps a
spam-blog harvesting posts before they are published.
This flaw is because Wordpress is trusting the $_SERVER['REQUEST_URI'] global
variable. Manipulation of $_SERVER['REQUEST_URI']has led to many xss flaws.
Although an attacher shouldn't be able to control all $_SERVER variables, none
of them should be trusted.
exploit:
htttp://localhost/wordpress/'wp-admin/
This will cause both $_SERVER['REQUEST_URI'] and $_SERVER['PHP_SELF'] to
contain the value:
htttp://localhost/wordpress/'wp-admin/
Vulnerable function:
line 34, in ./wp-includes/query.php.
function is_admin () {
global $wp_query;
return ($wp_query->is_admin || (stripos($_SERVER['REQUEST_URI'],
'wp-admin/') !== false));
}
The same flaw is duplicted in again on line 645 of the same file.
This url: htttp://localhost/wordpress/'wp-admin/
will cause the is_admin() function to return true. This flaw works regardless
of register_globas or magic_quotes_gpc. The attack fails when search engine
friendly urls are turned on in wordpress, however this option is turned off by
default. Turning search engine friendly urls on is a workaround until a patch
is created.
Peace