WordPress Exploit Allows Admin Password Reset

Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.

Comments

Re:Clarification

[Jellybob]

Using the special URL, the old password is removed and a new one generated in its place with no confirmation required.

While you're right in saying the attacker can't access the admin's account, the admin themselves also can't access it, because their password has already been reset to something else, and they'll have to get the new one. It seems more like a minor inconvenience to me, then a massive bug which will end the world, but still a flaw.

That's why I stopped using Wordpress

[krovisser]

I was tired of constantly having security issues and having to upgrade. Isn't there less feature-filled blog app out there that's all lightweight and whatnot?

Re:That's why I stopped using Wordpress

[Deanalator]

*laugh explosion* Ya, that's an awesome idea for making sure your app is secure. Remember that old rule about writing your own crypto? That still applies today to CMS webapps. Unless you have a *set* of friends that pentest webapps professionally, writing your own CMS is an absolutely terrible idea.

Re:That's why I stopped using Wordpress

[Deanalator]

blogspot

Unless you have a team of developers and pentesters constantly maintaining your blog, you are better off getting it hosted somehwere else. Any given blog instance that is not properly maintained is only going to remain secure for about 6 months or so. If you, or you and a few people, or even a small company just want a simple blog to post stuff on, and you don't want to hire a staff of infosec monkeys, blogspot is definitely the way to go. The code is maintained by google, and data is redundantly backed up for you for free.

Re:Clarification

[evanbd]

If I write a script that resets your password every 3 seconds, you'll find it to be more than a minor inconvenience.

Re:WordPress is Awesome

[dubbreak]

*opens dashboard, presses "Upgrade to 2.8.4" button*

Fixed. :D

Not sure why you got modded down (probably just the way you put it). Upgrading Wordpress is trivially easy.

Exploits happen, and this is a pretty minor one (just an annoyance, not user permission escalation, admin rights etc). They got a fix out quick and it's easy enough to apply.

Stupidity

[pkretek]

I wonder why somebody would code that part the way they did it. As far as I understand it, they are trying to validate code by blacklisting instead of whitelisting:

(from http://core.trac.wordpress.org/changeset/11798)
$key = preg_replace('/[^a-z0-9]/i', '', $key);
if ( empty( $key ) )
    die();

If you expect a hash you generated yourself, why don't you test if it preg_matches the spec you used to generate it in the first place? (/^[a-zA-Z0-9]{20}$/ in this case)

Well that and being naive enough to expect $_GET["key"] to always return a string....