‹ BackHN Continuity

Thread

WordPress: Unauthenticated path traversal leading to conditional RCE

240 points · 132 comments · vntok

  1. cyphar · · focus · HN ↗
    This kind of bug pathology is incredibly common in all sorts of programs and is the reason (disclaimer: self-plug) I wrote libpathrs[1].

    Sadly, almost all language standard libraries do not provide the right abstractions for dealing with files (the primary focus is on global paths as opposed to scoped paths or file descriptors / file handles) so it's little surprise bugs like these just keep popping up every few weeks.

    To eliminate these from your codebase you need to rethink and really focus on being aware of how you deal with files. If the program you're writing has root privileges then you need to be more careful about misdirected writes to /proc or other pseudofilesystems.

    [1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;cyphar&#x2F;libpathrs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;cyphar&#x2F;libpathrs

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.