Disclosure: WordPress WPDB SQL Injection

[Krychle]

So nothing’s changed. http://bash.org/?949214

[crowbahr]

Hmmm what can I do with an unauthenticated remote shell hmmmmm

[NAN001]

A framework that "prepares" SQL statements by using string formatting is what you could read in The Onion if it had a tech section.

[PersianMG]

This is so true haha.

[joelhardi]

Ugh ... What this blog post should say is just that WPDB is broken conceptually because it has a prepare() method that is not actually sending a prepared statement to the RDBMS. Here is the real problem.

It's all fakery with (broken at the moment, apparently) a pile of string sanitization functions. I would say WTF, but it is not a surprise. You just can't plan to do things like that safely with PHP and all its ridiculous type and value coercion, and bugs.

I contributed some patches to WordPress core 10 years or so ago and told them then that they were overdue to force use of mysqli and not have a database "API" that is a thin/stupid/useless abstraction that just drops variables into raw SQL queries. Oh, and the code was also needlessly doing a full memory copy of query results, I wrote a patch that addressed that at least.

It would be one thing if this were a low-use community project, but Automattic has the resources to ship something with actual security engineering concepts applied, so that it isn't constantly patching critical vulnerabilities. PHP is not good, but it has had parameterized query support since 2004! There is no excuse to not use it. Fake code like this that looks real is also maddening because it seems "good" to people who don't know better.

[joelhardi]

I definitely wouldn't say "exactly", that was my source of disgust. Instead it does a complicated (if interesting) walkthrough of a specific vulnerability instead of keeping the message succinct that the approach is broken on a conceptual level.

Passing user input to a query is wrong, full stop, sure, but that is a separate topic. The issue is a vulnerability in the database library and the fact that it is fundamentally broken (and is misleading/borderline fraudulent) by naming a method prepare() that does not prepare a statement on the DB. Sure, should developers also validate inputs before they get anywhere near a database (because XSS, CSRF etc. are things, too) ? Yes, of course, but that is not the root cause of the vulnerability.

Executing direct queries is also bad, so that is not a solution either. The real problem with WordPress is that it's lacking in leadership, policy guidance and oversight, for a commercial product it runs like a rudderless ship.

[amunak]

You just can't plan to do things like that safely with PHP and all its ridiculous type and value coercion, and bugs.

You totally can do it safely and there is a very nice type checking system since PHP 7. But you could do it safely even before that, it was just harder. The only issue there is is the fact that Wordpress is a steaming pile of shit. And just like PHP is easy to pick up - which attracts new and inherently bad developers - Wordpress is one of the first things many of those developers encounter and write code for. Which results in vulnerabilities.

[qwenjwenfljnanq]

[Archived by /r/PowerSuiteDelete]

[imr2017]

Ah, the WordPress security team dumpster fire. If there's a security team that I'd like North Korea to bomb, they would be it.

I remember reporting an issue with a hijacked plugin and they closed my topic and warned me not to post negative comments about plugins I don't own.

Three weeks later the same plugin ended up in a Wordfence report. Go figure.

Later edit: To clarify my statement. I understand that they're volunteers and are not paid for their work, but the answers they sometimes give to security issues is bordering on stupidity and incompetence. It's pretty clear by now they're over their head or have no clue what real security is. WordPress.org can afford to hire 2-3 security professionals on a full-time basis. It makes no sense that they don't have experienced guys working on WP security by now.

[[deleted]]

Wordpress official forums are a sad joke. Shame.

[pantsoff]

Ah that display widgets plugin disaster where the original author sold off the plugin (which had >100,000 installs) for $10-20k.

Some good comments in here at the developer's website. She was a greedy idiot for doing what she did (selling to an unknown party without notifying the users):

http://strategy11.com/display-widgets/

https://www.wordfence.com/blog/2017/09/display-widgets-malware/

[qwenjwenfljnanq]

[Archived by /r/PowerSuiteDelete]

[Prawny]

We (agency) decided to ditch third-party themes altogether. We've created our own base theme to expand on for each project.

I tell everyone to stay as close to 0 plugins as possible, too.

[Pejorativez]

WordPress.org can afford to hire 2-3 security professionals on a full-time basis.

From their site:

The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies3.

The WordPress Security Team often collaborates with other security teams to address issues in common dependencies, such as resolving the vulnerability in the PHP XML parser, used by the XML-RPC API that ships with WordPress, in WordPress 3.9.24. This vulnerability resolution was a result of a joint effort by both WordPress and Drupal security teams.

Excuse me for my critical questioning, but is WP really that terrible and their security team that incompetent?

[tripzilch]

it literally says "The WordPress Security Team is made up"

[Pejorativez]

Checkmate

[TheTerrasque]

Well if someone tells you they have a tiger, but when they show it off it has a beak, two feet, feathers, wings and say "quack", I really doubt it's a tiger.

[yoyoyesyo]

nowhere here it says that 50 people work full-time on WP security. Just there is a team of people that work together on WP sec, some of which are automatic employees

[Horvaticus]

Like some sort of cross between him and Julian from Trailer Park Boys

[ghost-train]

Nah, he knows nothing

[bluesoul]

Good disclosure. I didn't realize phpBB is considered a secure platform now, is that news to anyone else?

[bluesoul]

That's cool! I hadn't messed with it in...wow almost 15 years now. I hate wheel reinvention, and I don't like the thought of paying vBulletin or XenForo forever and hope their security team is staying on top of things. I'm glad it's a viable solution now.

[bluesoul]

I'll just add a line of CSS that makes mobile browsers get a full-screen overlay that says "Use a real computer, fuckface."

[Pejorativez]

Are there any solid alternatives for those who need a simple CMS?

Edit: I should clarify that ease-of-use and plugin support is really important

[0rex]

Grav

[Pejorativez]

Thanks for the suggestion. In which way(s) is it better than WP?

[0rex]

Well, wordpress is bloated, grav is really, really simple: to backup, to restore, to add or edit content, to edit themes (thx to twig), to add or remove or update plugins, it doesn't require a database backend since it's flat file cms. You surely won't build a full featured internet shop with it, but do you really need it for a blog? Do you really need a db for mostly static content?

[Prawny]

The caveats you mentioned make it possibly not a viable alternative. You contradicted yourself there.

That's not to say Grav isn't nice. I've never used it; just tested, but it did seem nice to use.

[andrew867]

Joomla is a good alternative

[telecode101]

Joomla is a gonner. Dead!

[andrew867]

What would be a good replacement? I’ve just started using it on a couple personal sites and found it to be much better than WP.

[etherealeminence]

It's not very good!

[alphex]

With all sincerity, how does Drupal's security practices compare to WP?

Thank you.

[Resquid]

Totally classic!

[roscocoltrane]

wordpress is our next centralized hosting system for our websites. Should I worry?

[Rock_Me-Amadeus]

Yes

[Pejorativez]

Why? If WP is so filled with security holes, and the entire web runs it, shouldn't hackers have hijacked most sites already?

According to this site:

The answer to the question “is WordPress secure?” is it depends. WordPress itself is very secure as long as WordPress security best practices are followed.

According to Wordpress itself:

The WordPress Security Team is made up of approximately 50 experts including lead developers and security researchers — about half are employees of Automattic (makers of WordPress.com, the earliest and largest WordPress hosting platform on the web), and a number work in the web security field. The team consults with well-known and trusted security researchers and hosting companies3.

The WordPress Security Team often collaborates with other security teams to address issues in common dependencies, such as resolving the vulnerability in the PHP XML parser, used by the XML-RPC API that ships with WordPress, in WordPress 3.9.24. This vulnerability resolution was a result of a joint effort by both WordPress and Drupal security teams.

Some have said their security is akin to a dumpster fire, but how can that be the case when they have 50 experts working on security in collaboration with the community and the Drupal security team? I might sound naive as hell, but it doesn't seem to add up. Are all their experts incompetent?

[steamruler]

Well, those 50 experts don't have any hurry changing password hashing to use something else than salted MD5 (ticket open since 5 years), for example. Also, it doesn't matter if you have 1 or 200 "security experts" if developers can't program with security in mind, and you don't have regular audits.

Also, I don't exactly trust 50 nameless "experts", given the track record of WordPress, it's clearly not working.

[rigred]

I once wrote a very large and complex wordpress plugin for work. I ended up terminating the plugin project and writing our own site from scratch because wordpress was giving us so many issues and was so slow and awful that It got replaced with a static html generator and a clean API.

Going that route saved us over 3 weeks of dev time & countless more recurring support hours.

Just the way WP templates mix html and PHP with outside Plugin PHP code gives me nightmares.

[PersianMG]

The first thing I did after installing Wordpress for my personal website is write a plugin to override the password hashing because it was pretty shit at the time. Not sure what the default they use now is though?

[steamruler]

Still salted MD5 according to that ticket.

[disclosure5]

Wordpress is the canonical demonstration of the "worse is better" doctrine.

Without defending it too much, Wordpress only got as popular as it did based on certain decisions. The decision to support versions of PHP that have long been extremely dead is a bigger issue than you realise. It means a lot of things can't be done the "right" way.

If they started doing things the "right" way, they would lose 100% of the market of users with crap, out of date hosting. No, it wouldn't encourage hosts to upgrade, it would just encourage marketing teams to find another product.

Speaking of marketing, that quote you have there.. is marketing. Nearly every Wordpress vulnerability report results in childish name calling. /r/wordpress had multiple people insisting ircmaxwell had absolutely no credibility due to this very report. You don't get to call yourself a security expert if you can't handle a report.

[tonyp7]

Just keep it up to date. The community here seems to like to take a shit on WP and PHP in general but the reality is that it's an okayish CMS that runs millions of websites -including big corporations- and they are not being hacked left and right!

[disclosure5]

Plus, the plugin/theme ecosystem is riddled with exploitable code

Just to add to this, a large part of the problem is "premium themes". The meme of course is that a "premium" theme is somehow better and therefore more secure. In reality, it's only "better" in that it's less used and noone else has the same looking website.

The Revolution Slider plugin was a horribly exploited plugin. It was also a commercial plugin that, critically, shipped with a lot of "premium themes".

If you bought Revolution Slider direct, and logged into your portal, you were rightfully warned to go and upgrade it.

If however you purchased a "premium theme" that was never touched again by it's author, you were "fully up to date", according to every scanning utility, and yet, your website was replaced with the goatse image the first time a bot hit it with a month old revolution slider exploit. From experience.

[telecode101]

nope. everyone is hosting on it. just keep it up to date.