A few security issues to takeover 34% of all websites Johannes - - PowerPoint PPT Presentation

▶
a few security issues
SMART_READER_LITE
LIVE PREVIEW

A few security issues to takeover 34% of all websites Johannes - - PowerPoint PPT Presentation

Aug 14, 2023 259 likes •643 views

A few security issues to takeover 34% of all websites Johannes Dahse, PHP.RUHR 2019 Dortmund, Germany, 08.11.2019 1 Intro Johannes Dahse Former CTF addict Security Consultant RIPS open source, static analysis for PHP security Ph.D. Static

slide-1
SLIDE 1

A few security issues

to takeover 34% of all websites

Johannes Dahse, PHP.RUHR 2019 Dortmund, Germany, 08.11.2019

1

slide-2
SLIDE 2

Intro

2

Johannes Dahse Former CTF addict Security Consultant RIPS open source, static analysis for PHP security Ph.D. Static Code Analysis @ Ruhr-University Bochum Co-Founder RIPS Technologies GmbH (since 2016)

slide-3
SLIDE 3

3

slide-4
SLIDE 4

Why WordPress?

4

500 KLOC PHP (+55.000 plugins) WordPress is used by 34.5% of the top 1M websites WordPress has a CMS market share of 61.2% ~240M unique domains = ~80M WordPress sites ~40M hosted on wordpress.com whitehouse.gov, Bloomberg, NBC, CNN, BBC, NYTimes

RoR Python

Usage of content management systems, W3Techs

slide-5
SLIDE 5

Roadmap

5

Pre-Auth Exploit authenticated functionality

slide-6
SLIDE 6

CVE-2019-9787 WordPress < 5.1.1 CSRF to Stored XSS

6

slide-7
SLIDE 7

Cross-Site Request Forgery (CSRF)

7

Comment via CSRF is a feature for trackbacks and pingbacks, but most HTML tags and attributes are stripped

slide-8
SLIDE 8

8

Cross-Site Request Forgery (CSRF)

attacker.com

slide-9
SLIDE 9

XSS filter bypass

9

slide-10
SLIDE 10

XSS filter bypass

10

<a rel="rips" title='XSS " onmouseover=evilCode() id=" '>

slide-11
SLIDE 11

XSS filter bypass

11

<a rel="rips" title='XSS " onmouseover=evilCode() id=" '> <a rel="rips" title= "XSS " onmouseover=evilCode() id=" ' ">

slide-12
SLIDE 12

12

Regular comment (filter_kses)

Exploit

slide-13
SLIDE 13

13

Regular comment (filter_kses)

Exploit

mysuperblog.com

slide-14
SLIDE 14

14

Regular comment (filter_kses) Admin comment via CSRF (filter_post_kses)

Exploit

mysuperblog.com

<a rel="rips" title= "XSS " onmouseover=evilCode() id=" ' ">

slide-15
SLIDE 15

Roadmap

15

Pre-Auth Exploit authenticated functionality

slide-16
SLIDE 16

CVE-2018-12895 WordPress < 4.9.7 File Delete to RCE

16

slide-17
SLIDE 17

17

Second-Order File Delete

slide-18
SLIDE 18

18

Second-Order File Delete

slide-19
SLIDE 19

19

Video: https://blog.ripstech.com/2018/wordpress-file-delete-to-code-execution/

slide-20
SLIDE 20

Roadmap

20

Pre-Auth Exploit authenticated functionality

slide-21
SLIDE 21

CVE-2019-8942 CVE-2019-8943 WordPress < 5.0.1 PT & LFI to RCE

21

slide-22
SLIDE 22

Modify Post Meta Data

_wp_attached_file

22

slide-23
SLIDE 23

Modify Post Meta Data

_wp_attached_file

23

_wp_page_template: Loads template file from /template/ dir No way to upload malicious template file

slide-24
SLIDE 24

Image Crop

24

Look for file in uploads/ directory Or try to fetch file via HTTP

slide-25
SLIDE 25

File Resolving

25

slide-26
SLIDE 26

File Resolving

26

evil.jpg?/../../template/evil.jpg

slide-27
SLIDE 27

Modify Post Meta Data

  • File Inclusion

27

slide-28
SLIDE 28

28

evil.jpg

include('templates/evil.jpg');

slide-29
SLIDE 29

29

Video: https://blog.ripstech.com/2019/wordpress-image-remote-code-execution/

slide-30
SLIDE 30

Bonus: CVE-2019-6977 PHP GD Extension Buffer Overflow

30

Imagick does not crop image exif meta data, GD does strip exif meta data when cropping

slide-31
SLIDE 31

Roadmap

31

Pre-Auth Exploit authenticated functionality

slide-32
SLIDE 32

WP Plugins Advent Calendar

32

slide-33
SLIDE 33

WordPress Security Advent Calendar

33

Critical bugs in 16 most-used plugins 21 million total active installations 8x WooCommerce (4M active installs)

slide-34
SLIDE 34

WordPress.org Stored XSS Worm

34

slide-35
SLIDE 35

Plugin Repository

35

SVN WP Plugin

slide-36
SLIDE 36

Stored XSS

36

→ XSS worm can add a new user as committer to this plugin, who then infects the version again, and adds a backdoor to the plugin <script>worm()</script>

slide-37
SLIDE 37

Thank you!

blog.ripstech.com Advent calendar 2019 announced soon!

johannes@ripstech.com / @FluxReiners

37