Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • Classic WordPress. Path traversal leading to conditional RCE always feels like a blast from the past.
    by brinepot
  • Ironically, this 9 years old comment on the official documentation page of one of the affected functions perfectly describes both the nature and remediation of this major security flaw:

    > Paul Ryan 9 years ago

    > Note that locate_template() does not prevent directory traversal attacks, so if you’re passing a user-provided template name to the function, be sure to verify that it’s from one of the three appropriate locations (active theme directory, parent theme directory, or /wp-includes/theme-compat/ directory).

    https://developer.wordpress.org/reference/functions/locate_t...

    by vntok
  • Is there a simple quick fix for older wp installs? I dont want to go through 20 meetings and two weeks of discussions
    by thenthenthen
  • The patch (identified from https://github.com/WordPress/wordpress-develop/compare/7.1.1...):

    https://github.com/WordPress/wordpress-develop/commit/9c4e85...

    by chrismorgan
  • I am so happy that I asked Codex to rewrite our website as Hugo templates which allowed us to statically host it and get rid of Wordpress. So much stress gone!
    by random_savv
  • This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1].

    Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so it's little surprise bugs like these just keep popping up every few weeks.

    To eliminate these from your codebase you need to rethink and really focus on being aware of how you deal with files. If the program you're writing has root privileges then you need to be more careful about misdirected writes to /proc or other pseudofilesystems.

    [1]: https://github.com/cyphar/libpathrs

    by cyphar
  • "WordPress 7.1.2 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7"

    As a courtesy, I try not to say more than one bad thing about WP every day. FWIW about 1/3 of installs are not on the recent 7 branch.

    by beezle
  • These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
    by zelphirkalt

Explore Birbla archives

WordPress: Unauthenticated path traversal leading to conditional RCE · Birbla