Plugin to stop wp-trackback DOS attack
|
View:
New views
10 Messages
—
Rating Filter:
Alert me
|
 |
Plugin to stop wp-trackback DOS attack
by Glenn Ansley
::
Rate this Message:
Hi All,
There have been several reports this morning of a DOS attack affecting the WordPress wp-trackback.php file. * [original post] http://www.stevefortuna.com/new-0-day-wordpress-exploit/ * http://jarraltech.com/2009/10/new-0-day-wordpress-exploit/ * http://www.hashbangcode.com/blog/wordpress-dos-attack-script-solution-2135.html All the the solutions have been the same thus far and require editing your .htaccess file or the wp-trackback.php file. FullThrottle has composed this quick plugin that accomplishes the same thing as the edit to the wp-trackback.php file. We will update this post and our code if further insight into the attack deems it necessary. We'd greatly appreciate any feedback this list has as well. You can download the plugin to test here: http://fullthrottledevelopment.com/wordpress-plugin-to-stop-trackback-dos-attacks or place the following in your theme's functions.php file: function ft_stop_trackback_dos_attacks(){ global $pagenow; if ( 'wp-trackback.php' == $pagenow ){ // DoS attack fix. if ( isset($_POST['charset']) ){ $charset = $_POST['charset']; if ( strlen($charset) > 50 ) { die; } } } } add_action('init','ft_stop_trackback_dos_attacks'); Thanks, Glenn Ansley http://fullthrottledevelopment.com _______________________________________________ wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by chrisbliss18
::
Rate this Message:
Thanks for the quick work on this Glenn. Looks like we can be expecting
a 2.8.5 soon. Chris Jean http://gaarai.com/ @chrisjean Glenn Ansley wrote: > Hi All, > There have been several reports this morning of a DOS attack affecting > the WordPress wp-trackback.php file. > > * [original post] http://www.stevefortuna.com/new-0-day-wordpress-exploit/ > * http://jarraltech.com/2009/10/new-0-day-wordpress-exploit/ > * http://www.hashbangcode.com/blog/wordpress-dos-attack-script-solution-2135.html > > All the the solutions have been the same thus far and require editing > your .htaccess file or the wp-trackback.php file. > > FullThrottle has composed this quick plugin that accomplishes the same > thing as the edit to the wp-trackback.php file. > > We will update this post and our code if further insight into the > attack deems it necessary. > We'd greatly appreciate any feedback this list has as well. > > You can download the plugin to test here: > http://fullthrottledevelopment.com/wordpress-plugin-to-stop-trackback-dos-attacks > > or place the following in your theme's functions.php file: > > function ft_stop_trackback_dos_attacks(){ > global $pagenow; > if ( 'wp-trackback.php' == $pagenow ){ > // DoS attack fix. > if ( isset($_POST['charset']) ){ > $charset = $_POST['charset']; > if ( strlen($charset) > 50 ) { die; } > } > } > } > add_action('init','ft_stop_trackback_dos_attacks'); > > Thanks, > Glenn Ansley > http://fullthrottledevelopment.com > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by navjotjsingh
::
Rate this Message:
Well this should be submitted to the Trac if you want to see it in next WP
version. On Tue, Oct 20, 2009 at 8:07 PM, Chris Jean <gaarai@...> wrote: > Thanks for the quick work on this Glenn. Looks like we can be expecting > a 2.8.5 soon. > > Chris Jean > http://gaarai.com/ > @chrisjean > > > > Glenn Ansley wrote: > > Hi All, > > There have been several reports this morning of a DOS attack affecting > > the WordPress wp-trackback.php file. > > > > * [original post] > http://www.stevefortuna.com/new-0-day-wordpress-exploit/ > > * http://jarraltech.com/2009/10/new-0-day-wordpress-exploit/ > > * > http://www.hashbangcode.com/blog/wordpress-dos-attack-script-solution-2135.html > > > > All the the solutions have been the same thus far and require editing > > your .htaccess file or the wp-trackback.php file. > > > > FullThrottle has composed this quick plugin that accomplishes the same > > thing as the edit to the wp-trackback.php file. > > > > We will update this post and our code if further insight into the > > attack deems it necessary. > > We'd greatly appreciate any feedback this list has as well. > > > > You can download the plugin to test here: > > > http://fullthrottledevelopment.com/wordpress-plugin-to-stop-trackback-dos-attacks > > > > or place the following in your theme's functions.php file: > > > > function ft_stop_trackback_dos_attacks(){ > > global $pagenow; > > if ( 'wp-trackback.php' == $pagenow ){ > > // DoS attack fix. > > if ( isset($_POST['charset']) ){ > > $charset = $_POST['charset']; > > if ( strlen($charset) > 50 ) { die; } > > } > > } > > } > > add_action('init','ft_stop_trackback_dos_attacks'); > > > > Thanks, > > Glenn Ansley > > http://fullthrottledevelopment.com > > _______________________________________________ > > wp-hackers mailing list > > wp-hackers@... > > http://lists.automattic.com/mailman/listinfo/wp-hackers > > > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by scribu
::
Rate this Message:
On Tue, Oct 20, 2009 at 5:49 PM, Navjot Singh <navjotjsingh@...>wrote:
> Well this should be submitted to the Trac if you want to see it in next WP > version. > http://core.trac.wordpress.org/ticket/10980 -- http://scribu.net _______________________________________________ wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by Michael Clark-14
::
Rate this Message:
If you are using custom permalinks, when is wp-trackback.php ever
called directly during the trackback process? I just tested this, and the only files accessed were ip.add.re.ss - - [20/Oct/2009:10:43:18 -0400] "HEAD /example-url HTTP/1.0" 200 - "-" "WordPress/; http://www.example.com" ip.add.re.ss - - [20/Oct/2009:10:43:18 -0400] "POST /xmlrpc.php HTTP/1.0" 200 297 "-" "The Incutio XML-RPC PHP Library -- WordPress/" ip.add.re.ss - - [20/Oct/2009:10:43:22 -0400] "HEAD /example-url HTTP/1.0" 200 - "-" "WordPress/; http://www.example.com" It seems to me that anyone ever accessing wp-trackback.php directly should be rejected, blocked, and/or firewalled. What am I missing? Both blogs tested using WP 2.8.4. My blog headers show /xmlrpc.php not wp-trackback.php. Aah, I see it now. If you aren't using pretty URLs, your trackbacks will be url/trackback/ . I use the Trackback Validator from http://seclab.cs.rice.edu/proj/trackback/ Will that plugin help protect against type of attack? Mike At 9:37 AM -0500 10/20/09, Chris Jean wrote: > >Glenn Ansley wrote: >> Hi All, >> There have been several reports this morning of a DOS attack affecting >> the WordPress wp-trackback.php file. >> > > * [original post] >http://www.stevefortuna.com/new-0-day-wordpress-exploit/ > > * >http://www.hashbangcode.com/blog/wordpress-dos-attack-script-solution-2135.html >> >> All the the solutions have been the same thus far and require editing >> your .htaccess file or the wp-trackback.php file. >> >> FullThrottle has composed this quick plugin that accomplishes the same >> thing as the edit to the wp-trackback.php file. >> >> We will update this post and our code if further insight into the >> attack deems it necessary. >> We'd greatly appreciate any feedback this list has as well. >> >> You can download the plugin to test here: >> >>http://fullthrottledevelopment.com/wordpress-plugin-to-stop-trackback-dos-attacks >> >> or place the following in your theme's functions.php file: >> >> function ft_stop_trackback_dos_attacks(){ >> global $pagenow; >> if ( 'wp-trackback.php' == $pagenow ){ >> // DoS attack fix. >> if ( isset($_POST['charset']) ){ >> $charset = $_POST['charset']; >> if ( strlen($charset) > 50 ) { die; } >> } >> } >> } >> add_action('init','ft_stop_trackback_dos_attacks'); >> >> Thanks, >> Glenn Ansley > > http://fullthrottledevelopment.com -- Michael Clark http://www.PlanetMike.com Listen to Christmas music 24 hours a day 7 days a week: http://www.ChristmasMusic247.com "Injustice anywhere is a threat to justice everywhere." - Martin Luther King Jr. _______________________________________________ wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
|
|
|
Re: Plugin to stop wp-trackback DOS attack
by Otto-19
::
Rate this Message:
It fixes the exploit in particular, but not the underlying issue. A
trivial change to the exploit can still trigger it. To fix the problem itself, there needs to be an additional change. Make this: if ($charset) $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); else $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; into this: if ($charset && is_string($charset)) $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); else $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; That will correct another vector for the same attack. -Otto On Tue, Oct 20, 2009 at 6:59 PM, Lynne Pope <lynne.pope@...> wrote: > WordPress 2.8.5: Hardening Release http://j.mp/3gZDRS > > This should fix the new 0-day exploit. > > Lynne > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by g30rg3_x-2
::
Rate this Message:
Hi Otto,
Thats the same i think after i see the patch by ryan... But after a more closer look i see that strtoupper() and trim() actually workaround/fix that issue when charset is and a array of charsets. A simple test script made to prove this point... $charset = array('UTF-8','UTF-8','UTF-8'); $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); var_dump($charset); And this script will just output the next text... string(5) "ARRAY" So as you can see, trim takes the array of charset (that in theory if happens to reach mb_convert_encoding as and array of charsets it will still be vulnerable to the dos attack) and work with it as and a string, in case that trim fails, strtoupper will also do the same and therefore it will convert the array() into a the string "array". More than be exploitable is just plain bug (with no exploitable issue) which as you say should be fixed with the proposed patch... Regards 2009/10/21 Otto <otto@...>: > It fixes the exploit in particular, but not the underlying issue. A > trivial change to the exploit can still trigger it. To fix the problem > itself, there needs to be an additional change. > > > Make this: > > if ($charset) > $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); > else > $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; > > > into this: > > if ($charset && is_string($charset)) > $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); > else > $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; > > > That will correct another vector for the same attack. > > -Otto > > > > On Tue, Oct 20, 2009 at 6:59 PM, Lynne Pope <lynne.pope@...> wrote: >> WordPress 2.8.5: Hardening Release http://j.mp/3gZDRS >> >> This should fix the new 0-day exploit. >> >> Lynne >> _______________________________________________ >> wp-hackers mailing list >> wp-hackers@... >> http://lists.automattic.com/mailman/listinfo/wp-hackers >> > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > -- /** CONFIDENTIALITY NOTICE: This message is intended to be viewed only by the listed recipient(s). It may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. Any dissemination, distribution or copying of this message is strictly prohibited without our prior written permission. If you are not an intended recipient, or if you have received this communication in error, please notify us immediately by return e-mail and permanently remove the original message and any copies from your computer and all back-up systems. */ _________________________ g30rg3_x _______________________________________________ wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by Otto-19
::
Rate this Message:
Hmm... While the trim does eliminate the issue, it seems to be
dependent upon which version of PHP you're using. When I tried it with 5.3, I get a null back instead of "array". It is conceivable (though it would take a lot of testing) that some particular version of PHP, or combination of extensions, could make a site vulnerable. Essentially, it depends the behavior of trim. I has assumed that passing trim an array would cause a warning (it does), and then continue at the next code segment. In your case, it converts to the string "array". In mine, I get a null value from it. However in both cases, the $charset does get overwritten with that value. Still, I don't think it's a great idea to rely on undocumented behavior to prevent the issue here, but I do agree that it is not a pressing problem. -Otto On Wed, Oct 21, 2009 at 10:26 AM, g30rg3_x <g30rg3x@...> wrote: > Hi Otto, > > Thats the same i think after i see the patch by ryan... > But after a more closer look i see that strtoupper() and trim() > actually workaround/fix that issue when charset is and a array of > charsets. > > A simple test script made to prove this point... > $charset = array('UTF-8','UTF-8','UTF-8'); > $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); > var_dump($charset); > > And this script will just output the next text... > string(5) "ARRAY" > > So as you can see, trim takes the array of charset (that in theory if > happens to reach mb_convert_encoding as and array of charsets it will > still be vulnerable to the dos attack) and work with it as and a > string, in case that trim fails, strtoupper will also do the same and > therefore it will convert the array() into a the string "array". > More than be exploitable is just plain bug (with no exploitable issue) > which as you say should be fixed with the proposed patch... > > Regards > > 2009/10/21 Otto <otto@...>: >> It fixes the exploit in particular, but not the underlying issue. A >> trivial change to the exploit can still trigger it. To fix the problem >> itself, there needs to be an additional change. >> >> >> Make this: >> >> if ($charset) >> $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); >> else >> $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; >> >> >> into this: >> >> if ($charset && is_string($charset)) >> $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); >> else >> $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; >> >> >> That will correct another vector for the same attack. >> >> -Otto >> >> >> >> On Tue, Oct 20, 2009 at 6:59 PM, Lynne Pope <lynne.pope@...> wrote: >>> WordPress 2.8.5: Hardening Release http://j.mp/3gZDRS >>> >>> This should fix the new 0-day exploit. >>> >>> Lynne >>> _______________________________________________ >>> wp-hackers mailing list >>> wp-hackers@... >>> http://lists.automattic.com/mailman/listinfo/wp-hackers >>> >> _______________________________________________ >> wp-hackers mailing list >> wp-hackers@... >> http://lists.automattic.com/mailman/listinfo/wp-hackers >> > > > > -- > /** > CONFIDENTIALITY NOTICE: This message is intended to be viewed only by > the listed recipient(s). > It may contain information that is privileged, confidential and/or > exempt from disclosure under applicable law. > Any dissemination, distribution or copying of this message is strictly > prohibited without our prior written permission. > If you are not an intended recipient, or if you have received this > communication in error, please notify us immediately by return e-mail > and permanently remove the original message and any copies from your > computer and all back-up systems. > */ > _________________________ > g30rg3_x > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
|
|
Re: Plugin to stop wp-trackback DOS attack
by g30rg3_x-2
::
Rate this Message:
m using php 5.2.6...
And it only notices about the implicit conversion if obviously notices are turned on. I do believe that it should be patch with the your proposal, cause the script is actually expecting a string not and array... Regards 2009/10/21 Otto <otto@...>: > Hmm... While the trim does eliminate the issue, it seems to be > dependent upon which version of PHP you're using. When I tried it with > 5.3, I get a null back instead of "array". It is conceivable (though > it would take a lot of testing) that some particular version of PHP, > or combination of extensions, could make a site vulnerable. > > Essentially, it depends the behavior of trim. I has assumed that > passing trim an array would cause a warning (it does), and then > continue at the next code segment. In your case, it converts to the > string "array". In mine, I get a null value from it. However in both > cases, the $charset does get overwritten with that value. > > Still, I don't think it's a great idea to rely on undocumented > behavior to prevent the issue here, but I do agree that it is not a > pressing problem. > > -Otto > > > > On Wed, Oct 21, 2009 at 10:26 AM, g30rg3_x <g30rg3x@...> wrote: >> Hi Otto, >> >> Thats the same i think after i see the patch by ryan... >> But after a more closer look i see that strtoupper() and trim() >> actually workaround/fix that issue when charset is and a array of >> charsets. >> >> A simple test script made to prove this point... >> $charset = array('UTF-8','UTF-8','UTF-8'); >> $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); >> var_dump($charset); >> >> And this script will just output the next text... >> string(5) "ARRAY" >> >> So as you can see, trim takes the array of charset (that in theory if >> happens to reach mb_convert_encoding as and array of charsets it will >> still be vulnerable to the dos attack) and work with it as and a >> string, in case that trim fails, strtoupper will also do the same and >> therefore it will convert the array() into a the string "array". >> More than be exploitable is just plain bug (with no exploitable issue) >> which as you say should be fixed with the proposed patch... >> >> Regards >> >> 2009/10/21 Otto <otto@...>: >>> It fixes the exploit in particular, but not the underlying issue. A >>> trivial change to the exploit can still trigger it. To fix the problem >>> itself, there needs to be an additional change. >>> >>> >>> Make this: >>> >>> if ($charset) >>> $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); >>> else >>> $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; >>> >>> >>> into this: >>> >>> if ($charset && is_string($charset)) >>> $charset = str_replace( array(',', ' '), '', strtoupper( trim($charset) ) ); >>> else >>> $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS'; >>> >>> >>> That will correct another vector for the same attack. >>> >>> -Otto >>> >>> >>> >>> On Tue, Oct 20, 2009 at 6:59 PM, Lynne Pope <lynne.pope@...> wrote: >>>> WordPress 2.8.5: Hardening Release http://j.mp/3gZDRS >>>> >>>> This should fix the new 0-day exploit. >>>> >>>> Lynne >>>> _______________________________________________ >>>> wp-hackers mailing list >>>> wp-hackers@... >>>> http://lists.automattic.com/mailman/listinfo/wp-hackers >>>> >>> _______________________________________________ >>> wp-hackers mailing list >>> wp-hackers@... >>> http://lists.automattic.com/mailman/listinfo/wp-hackers >>> >> >> >> >> -- >> /** >> CONFIDENTIALITY NOTICE: This message is intended to be viewed only by >> the listed recipient(s). >> It may contain information that is privileged, confidential and/or >> exempt from disclosure under applicable law. >> Any dissemination, distribution or copying of this message is strictly >> prohibited without our prior written permission. >> If you are not an intended recipient, or if you have received this >> communication in error, please notify us immediately by return e-mail >> and permanently remove the original message and any copies from your >> computer and all back-up systems. >> */ >> _________________________ >> g30rg3_x >> _______________________________________________ >> wp-hackers mailing list >> wp-hackers@... >> http://lists.automattic.com/mailman/listinfo/wp-hackers >> > _______________________________________________ > wp-hackers mailing list > wp-hackers@... > http://lists.automattic.com/mailman/listinfo/wp-hackers > -- _________________________ g30rg3_x _______________________________________________ wp-hackers mailing list wp-hackers@... http://lists.automattic.com/mailman/listinfo/wp-hackers |
| Free embeddable forum powered by Nabble | Forum Help |
