Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

tptacek · 1790096527 · focus · HN ↗
These CVSS scores don't mean anything and it would be better for everyone if they stopped showing up in headlines. This is a somewhat situational Wordpress RCE that impacts only a couple themes.
1. vntok · 1790097204 · focus · HN ↗
  > This is a somewhat situational Wordpress RCE that impacts only a couple themes. reply
  That is dangerously incorrect, a whole lot of themes are vulnerable. The main pre-condition, "presence of a top-level directory named 'page-xxx' like 'page-templates' in the theme's directory" is actually an official recommendation in the WordPress documentation.
  See here: <a href="https://developer.wordpress.org/themes/classic-themes/templates/page-template-files/" rel="nofollow">https://developer.wordpress.org/themes/classic-themes/templa...
  > As discussed in Organizing Theme Files, WordPress can recognize page templates stored in the theme’s root folder or in a first-level subdirectory of the theme folder. *The page-templates/ folder is a common convention* for organizing global page templates, but it is not required. Page templates can also be stored in other first-level subdirectories, such as templates/ or page_templates/.
  1. dawnerd · 1790099765 · focus · HN ↗
    Yeah not sure why you’re being downvoted when the built in themes are vulnerable as is the default docker image pre php8.5 which a lot of people use as a base and I bet a lot of hosting providers use as well behind the scenes.
  2. AlienRobot · 1790118715 · focus · HN ↗
    I'm not sure I understand. That's the main pre-condition... to include an arbitrary PHP that is already in the server.
    On a fresh WP install, a random user can't upload PHP files. Normally you don't even need to allow random users to register an account since avatars on comments come from gravatar anyway.
    vntok · 1790164654 · focus · HN ↗
    > On a fresh WP install, a random user can't upload PHP files.
    Indeed, but you don't need to upload anything as long as there's already a PHP file that allows you to execute arbitrary commands somewhere on the server, right?
    Well, as it turns out, the default PHP Docker image has had such a file readily available until version 8.5 =)
    AlienRobot · 1790181196 · focus · HN ↗
    Jesus. I don't think WP is nice to use, but people are saying WP is crap because someone else made pearcmd.php that allows you to run arbitrary commands, and then a third someone else included that in the default PHP docker image. In this case all PHP CMS's are a directory traversal bug away from this CVE.
    vntok · 1790242304 · focus · HN ↗
    Indeed. Then again, it's on WordPress not to have directory traversal flaws in their core functions...
    - especially the functions that are explicitely exposed to be used on front-facing interfaces (ie: templating functions).
    - and especially when the security flaw in question was not only raised 9 years ago but described in details on the official documentation page of the affected function

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.