Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

zelphirkalt · 1790100372 · focus · HN ↗
These are the reason, why every easily reachable web server will be spammed with /something/something.php?somearg=someval. If I had to guess, which software on the web has been the most exploitable over all of the web's history, WP would surely be among the top candidates. Maybe right after MS Teams or Sharepoint or some stuff like that.
1. nom · 1790103843 · focus · HN ↗
  The access log of public http servers is truly interesting to watch.
  You know that the scripts doing it are optimized for success rate, so the types of requests they send give you an impression of what's actually out there.
  It's clear to me that once we finally achieve rogue AGI, it is going to propagate through unpatched WordPress WooCommerce instances.
  1. mitxela · 1790105333 · focus · HN ↗
    Not success rate per request though.
  2. lyu07282 · 1790111752 · focus · HN ↗
    It seems the most common issue of them all is an exposed .env file by that measure.
    graemep · 1790158397 · focus · HN ↗
    I think that is very likely to be common. It is an easy mistake to make if your code is in a directory the web server can read, which is common, and is usual with PHP.
  3. jamesfinlayson · 1790145394 · focus · HN ↗
    Yep I see this at work pretty regularly - a SpringBoot log file full of requests for all sorts of things (mostly WordPress but I think some IIS as well).

Unofficial Hacker News client; not affiliated with Y Combinator.