Slashdot Mirror

← Back to Stories (view on slashdot.org)

Millions At Risk From Critical Vulnerabilities From WordPress Plugins

Posted by Unknown on from the just-use-ur-web dept.

First time accepted submitter dougkfresh writes "Checkmarx's research lab identified that more than 20% of the 50 most popular WordPress plugins are vulnerable to common Web attacks, such as SQL Injection. Furthermore, a concentrated research into e-commerce plugins revealed that 7 out of the 10 most popular e-commerce plugins contain vulnerabilities. This is the first time that such a comprehensive survey was prepared to test the state of security of the leading plugins." It does seem that Wordpress continues to be a particularly perilous piece of software to run. When popularity and unsafe languages collide.

33 of 145 comments (clear)

  1. Not an unsafe language... by dclozier · · Score: 5, Insightful

    Just bad coding. Any language can be coded with badly. (some more easily or accidentally than others)

    1. Re:Not an unsafe language... by Anonymous Coward · · Score: 4, Funny

      It's not bad coding, those are just misunderstood features. SQL Injection? - That's just a back door we left in for convenience.

    2. Re:Not an unsafe language... by Anonymous Coward · · Score: 5, Funny

      I personally only use HTML9 Responsive Boilerstrap JS. If you're using any other framework then you're just wasting your time.

      Here's a link for you poor slobs that haven't jumped on the bandwagon.

      http://html9responsiveboilerstrapjs.com/

    3. Re:Not an unsafe language... by ackthpt · · Score: 4, Insightful

      Just bad coding. Any language can be coded with badly. (some more easily or accidentally than others)

      Well, yeah, other than [INSERT FAVORITE LANGUAGE HERE]. Any programmer worth his or her salt knows that language has all sorts of obvious safeguards against this sort of thing if you have even the vaguest clue what you're doing, which makes it that much more betterer and you should all use it right now and hire me for lots of money.

      Assuming management or the analyst who specs the code gives the coder sufficient time to do it right.

      Something I continue to observe in outsourced code is an incredible sense of optimism regarding security. Not because the coder is a fool (well, he/she might be) but because security and good practices are not emphasised, time and cost of up front development are too often the deciding factors.

      --

      A feeling of having made the same mistake before: Deja Foobar
    4. Re:Not an unsafe language... by Hognoxious · · Score: 2

      Is it webscale, or does it use joins?

      --
      Confucius say, "Find worm in apple - bad. Find half a worm - worse."
    5. Re:Not an unsafe language... by Giant+Electronic+Bra · · Score: 4, Insightful

      Some encourage it more than others, and some provide security-oriented features. For instance perl's taint mode is a great security feature. Truthfully strong typing and mature frameworks go a long ways, IF you know how to use them.

      HOWEVER all this is secondary. The appalling thing is THAT NONE OF THESE PLUGINS WERE EVER AUDITED. Any webapp is almost sure to have some sort of hole in it. You can plug them but its tricky and no team will find them all. The question then is how on God's Green Earth have so many people deployed this stuff and not audited it thoroughly (or at all)? I taught web-app security and was one of the earliest people in the business, I'd never in a million years deploy one of these plugins for a client and not beat it to death with a fuzzer and 10 other things. This is just basic crap I was teaching in my college courses 8 years ago (and it wasn't exactly revolutionary then). Hell, I don't consider myself any sort of security genius by a long shot, but all I can say is that there are a lot of scarily ignorant fools out there...

      --
      "Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
    6. Re:Not an unsafe language... by chuckinator · · Score: 5, Insightful

      Auditing isn't cool and takes time that could be better spent posting pictures of food with a sepia filter on Instagram.

    7. Re:Not an unsafe language... by Larryish · · Score: 2

      My marketing department uses it because the rubygems facepalm API really lets us utilize turn-key e-tailers in order to better monetize one-to-one vortals.

    8. Re:Not an unsafe language... by ArcadeMan · · Score: 4, Funny

      Is that a dog?

      --
      Get free satoshi (Bitcoin) and Dogecoins
    9. Re:Not an unsafe language... by indeterminator · · Score: 2

      The question then is how on God's Green Earth have so many people deployed this stuff and not audited it thoroughly (or at all)?

      Because your client will want new plugins every week, gets tired of asking you everytime, and wants you to set up the permissions so that the GUI plugin installer works ("what do you mean not a good idea? the last site I had worked that way and I never had any problems with it"), then proceeds to install all the plugins he needs to make his blog on cats and other larger-than-life stuff buzzword compatible.

    10. Re:Not an unsafe language... by dgatwood · · Score: 2

      The appalling thing is THAT NONE OF THESE PLUGINS WERE EVER AUDITED.

      Does this surprise anyone? There's a good reason why WordPress systems are popular targets for hacking....

      That said, to some degree, I blame the language designers for not being more aggressive at forcing people to upgrade their old-style SQL queries to use a more modern, parameterized syntax.

      If you really want the web to be more secure, we should:

      • Eliminate the PHP/Perl/Python mysql extensions. Force everyone to rewrite their software with either mysqli or PDO. Period.
      • Add tainted data tracking into the language runtime for PHP, Perl, Python, etc. This means:
        • All data coming from outside the code itself (from all files, from GET/POST request fields, etc.) is marked as tainted.
        • String concatenation of tainted data with untainted data results in tainted data.
        • Variable substitution of tainted data inside a string results in a tainted string.
        • Taint is preserved across function calls, such as explode/implode.
        • Data can only become untainted by casting it to a numeric type. (No, mysql_real_escape_string should not untaint anything. That function is a hack. You shouldn't be using it in production code.)
      • All mysqli and PDO functions/methods should throws an exception if a tainted string is passed as a format argument.
      • When the language is running in a web server, all output to stdout (to a browser) should similarly throw an error unless the taint type matches the current Content-Type value. For example, if the headers say Content-Type: text/html, then input from an HTML file is not tainted. Input from a database or text file should have to be either quoted for output or sanitized through your choice of sanitizer functions, tailored for various purposes (e.g. an anti-XSS sanitizer).

      And so on. These changes would go very, very far towards eliminating SQL injection attacks and XSS. The fact that such protection schemes are both incomplete and disabled by default in most programming languages suggests to me that security is not a high enough priority.

      IMO taint protection should be part of the default configuration when running in a web server environment. If there are bugs that make that impossible, then those should be the absolute highest priority bugs on the plates of the language engineers.

      In the meantime, everyone should add taint_error_level = E_ERROR to your php.ini file, etc.

      --

      Check out my sci-fi/humor trilogy at PatriotsBooks.

  2. Every language is unsafe. by Qzukk · · Score: 4, Insightful

    It's just that PHP has managed to attract a huge number of absolute retards who do things like evaluate image files (it WAS an image file you uploaded, right? It ended in .gif, right? So it's totally an image file and I shouldn't even be bothered to verify the contents because nobody would ever upload php code ending in .gif) in order to dump the contents out to the browser instead of using ANY of the multiple functions or methods to do just that securely.

    --
    If I have been able to see further than others, it is because I bought a pair of binoculars.
    1. Re:Every language is unsafe. by cold+fjord · · Score: 4, Insightful

      More like every language can be used unsafely, and some have built-in weakness in addition. The C language and many of its derivatives have a number of issues that are well known and documented. In that regard both Unix and C are like chainsaws - in skilled hands they make short work of difficult problems that might be far harder or impossible with other tools, but let your attention wander for a moment and you are missing a leg.

      --
      much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
    2. Re:Every language is unsafe. by MtHuurne · · Score: 3, Informative

      That's the wrong question: instead of performing a dangerous operation only if the input doesn't look suspicious, you should not perform the dangerous operation at all. So if the input data is supposed to be an image, pass it to a function that can only process images. That way, if an attacker does manage to sneak in PHP code disguised as an image, it will just trigger an error condition instead of being executed.

    3. Re:Every language is unsafe. by Anonymous Coward · · Score: 4, Funny

      They could exploit GD.

      The only solution is to have the user base64 encode the binary GIF data, print it and then snail mail it to you.

      You can then build a dedicated PC that's not on the network, type out the base64 data, decode it and confirm it's a valid GIF. Then connect that PC to the network and upload the GIF on behalf of the user.

      If the GIF was malicious you simply set that dedicated PC on fire, inform the user (via snail mail) "INVALID GIF IMAGE, PLEASE TRY AGAIN" and then buy another dedicated PC for the next GIF you receive.

      It's the only way to be safe. I do this with my site and so far so good: I launched one year ago and I've received 1 GIF so far 3 months ago and I'm about 75% done typing all the base64 data. I hope to confirm his avatar picture by July 1st!

    4. Re:Every language is unsafe. by dkleinsc · · Score: 4, Insightful

      Every language is unsafe, but some almost try to be as unsafe as possible.

      For example, the oldest (and until fairly recently, only) way of handling database queries in PHP pretty much asks for you to be vulnerable to SQL injection attacks, because there's no parameterization so all you can do is awkwardly run a hodgepodge of escaping functions and hope they work. By contrast, Perl, Java, Python, and C# all provide support for parameterizing queries in their standard approaches to handling database queries about 10 years before PHP did. That's the kind of thing that gives PHP its bad reputation.

      --
      I am officially gone from /. Long live http://www.soylentnews.com/
    5. Re:Every language is unsafe. by Dragonslicer · · Score: 3, Informative

      For example, the oldest (and until fairly recently, only) way of handling database queries in PHP pretty much asks for you to be vulnerable to SQL injection attacks, because there's no parameterization so all you can do is awkwardly run a hodgepodge of escaping functions and hope they work. By contrast, Perl, Java, Python, and C# all provide support for parameterizing queries in their standard approaches to handling database queries about 10 years before PHP did. That's the kind of thing that gives PHP its bad reputation.

      Depends on your definition of "fairly recently." PDO was available as an extension for PHP 5.0 (2004) and was included in the standard installation for PHP 5.1 (2005). There hasn't been any excuse not to be using it for at least 5 years.

    6. Re:Every language is unsafe. by Qzukk · · Score: 2

      is it generally safe to store them in a .htaccess-restricted folder provided that the filename has been cleansed of path separators

      The htaccess restriction is important to prevent one of the other leading causes of PHP vulnerability: Allowing someone to upload a valid jpeg with a .php file extension in an image field and not checking the file extension before putting it somewhere someone can request <img src="profilepics/pwnme.php"> from the server. In fact, don't try to cleanse the filename. Just assign it one yourself. Keep the original filename in a database (aware of SQL injection) if you think someone will completely flip out if they can't find out what the file was named, and keep userpic12345.[extension as determined from content]

      Part of the reason why PHP is such a large gun for shooting yourself in the foot is that it mixes content and code by design, so you have to have a few extra precautions when accepting content from somewhere else that it doesn't have unwanted code mixed in. Some of the precautions are basic PHP (like "include() is not how you read a file"), others take a little more awareness of the entire environment (like "the webserver will happily execute anything anyone uploads with a php extension in a folder accessible from the web").

      --
      If I have been able to see further than others, it is because I bought a pair of binoculars.
  3. e-commerce plugins vulnerable by schneidafunk · · Score: 3, Interesting

    According to the PDF, e-commerce plugins are in the list. I'm a bit surprised to see that, as I assumed developers would be thinking about security first with e-commerce.

    --
    Some people die at 25 and aren't buried until 75. -Benjamin Franklin
    1. Re:e-commerce plugins vulnerable by Vanderhoth · · Score: 3, Interesting

      I agree it should be the first consideration, but the people who want the implementation are MBAs that care more about getting people's money, return on investments and how something looks rather than how secure it is.

      <sarcasm>Why pay money up front for security you might never need? It's better to wait until something does happen, like millions of credit card nubmers are stolen, and give the money to the PR people to clean up the mess. It's way cheaper if the gamble pays off.</sarcasm>

    2. Re:e-commerce plugins vulnerable by Algae_94 · · Score: 2

      They only did a study on plugins. They must be assuming that WordPress itself is super secure. Bad assumption.

  4. Let's keep the tree green by dkegel · · Score: 2

    The solution is easy: hosting providers should be required to continuously run vulnerability scanners, and instantly take down any sites which have known vulnerabilities. As a bonus, it would clear out a lot of crap sites.

    1. Re:Let's keep the tree green by Spy+Handler · · Score: 2

      I don't know about "should be required", who's going to require them, Congress? DOJ?

      However the smarter ones do just what you described, out of their own self interest. My hosting company contacted me once about a vulnerable Mambo extension they found.

    2. Re:Let's keep the tree green by dkegel · · Score: 2

      Congress, say.

      And of course 'instantly' would be too gestapo for real life. We'd really want a grace period with escalating warnings, followed by fines, followed by pulling-the-plug.

      And it'd be much better if industry came up with this on its own first. What's the state of the art?

      Rackspace talks about security,
      http://www.rackspace.com/managed_hosting/services/security/
      but doesn't seem to offer proactive vulnerability scanning, and if they did, they would charge for it instead of just doing it.

      Godaddy seems to offer this as an extra cost
      service instead of just doing it:
      http://www.godaddy.com/security/website-security.aspx

      Here's one wordpress hosting provider that promises to install all security updates within one hour (wow):
      https://wpengine.com/security/

      So, industry guys, can we get our act together and offer security scans and upgrades as part of the basic service plan?

  5. Re:In case you were wondering... by slashmydots · · Score: 3, Funny

    ohhhhh that's right, my second degree is in software programming with .NET and ASP

  6. Re:In case you were wondering... by slashmydots · · Score: 2

    Read the reply right above you. Spoiler alert, I'm also an offline software programmer.

  7. Re:In case you were wondering... by Zedrick · · Score: 5, Insightful

    I used to be of the same opinion, but... I've been working in the hosting business for 10 years now, and that kind of attitude doesn't really work in real life.

    It's 2013, most people (at least in developed countries with high IT penetration) have their own domain and website nowadays. Do you really think it's fair to call a 50 year old woman who wants a nice website for her cat-blog a moron? Or the coin collector who don't care about computing but just want to write about English hammered coins? Or the fishing club whose members wants a nice looking site with a gallery and perhaps a public calendar? Or the girlfriend who wants to blog about cooking? Are they all morons?

    Websites are not just for companies or IT-people anymore.

    Also, Wordpress is way way better than it used to be a few years ago (unlike Joomla which is a total fail in every version). Since 3.5.1 was released, I've seen more customers hacked due to brute force logins than security exploits in outdated themes or plugins.

  8. Re:In case you were wondering... by amicusNYCL · · Score: 2

    From where does one get a degree in .NET?

    --
    "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
  9. Ooh, scary Open Source, look at the nasties by xenoc_1 · · Score: 5, Insightful

    Great, Dice posts story from a corporate-software-industrial-complex advertorial mag, with a link to their so-called blog. Which ironically is running WordPress, along with a bunch of common plugins like "Yoast WordPress SEO plugin v1.4.7" and "All in One SEO Pack 1.6.14.6". Right there tells me how clueless they are about WordPress, because unless you have a damn good special reason, you do not want to be running two separate SEO plugins. LeadGen contact form plugin, a bunch of ad and analytics beyond the usual, and no apparent caching plugin. Oh, and no Google Authorship id done the correct way, despite both of those SEO plugins having "fill in the blank" prompting for it (they do have an XFN tag on their contact info but don't do the full Google social.)

    For more laughs, their verison of All-In-One SEO is downlevel. Exactly what Checkmarx themselfes warn agansit. They are on 1.6.14.6, current version is 2.0.2.

    Yeah, I'm gonna listen to them about WordPress security.

    When you click through their blog to the actual PDF report, guess what? They redacted the names of all those "at-risk" plugins, noting only 6 by name. Four of which they claim took their advice and fixed the problem, and two (WP Super Cache and W3 Total Cache) which I recall getting fixes for months ago. Hot news. I guess that even though their supposed expertise is in scanning for vulnerabilities, they are not going to tell you which are at risk in the current environment, because you didn't pay them. Classic dipstick move. Total and utter unawareness of the karmic and $$ benefits of internet "gift culture", such as, the whole damn open source movement and the specific WordPress ecosystem in which they are supposedly expert.

    But we should listen to them, because: Checkmarx was recognized by Gartner as sole visionary in their latest SAST magic quadrant and as
    Cool vendor in application security.

  10. Re:Do not panic by lightknight · · Score: 2

    Well, the problem is some of the more intelligent crackers out there have been upping their game recently...they have, if memory serves me correctly, found ways of getting websites to arbitrarily become a part of botnets. That's right, it's no longer just a matter of your website's database being compromised, with your liability ending with a broadcasted message to everyone telling them to change their passwords / check their credit cards...now your website, or rather the host machine that the website is running on, can be hijacked into DDOS'ing the DHS's main servers, or something equally tasteful. If repeated phone calls from the bank telling you to fix your website's code was enough motivation, then possibly a heart to heart talk with Agent Bob and Agent Rob will. And I'm sure the part where you tell them that you hired the lowest bidder to build the site (or just used the built-in), use a Mac because you're super-bad with computers (but still have a blog, because of that advertising money, amiright?), and that you have no idea how to fix it, and thus can't be held accountable for whatever has happened, will go over well with them. It'll be a real knee-slapper, you'll be laughing, they'll be laughing, and the whole thing will be cleaned right up inside of a week.

    In other news, the DoJ may have found a use for all those crackers they plan on catching -> early-release program, clean-slate, provided they fix WordPress and help hunt down the old installs. Should keep them busy for the next several eons...

    --
    I am John Hurt.
  11. Which Ones?!?! by Rob+Riggs · · Score: 5, Insightful

    What an absolutely useless article and report. Scaremongering at its best, with no actionable content. Which plugins have vulnerabilities? Can they be mitigated through configuration changes or do they need to be disabled/uninstalled? What is the potential exposure? Those are the sort of things a computer professional needs. Where are the damned CVEs?

    --
    the growth in cynicism and rebellion has not been without cause
  12. Re:The issue that I've noticed is with small busi. by lightknight · · Score: 2

    Welcome to reality. Some people believe that the best way to 'get through life' is by being at the top of things...you may not know how to do anything, but you know how to pull the cord that does something. Some people believe that the best way to 'get through life' is by being the best you can be at something, even if you are terri-bad at everything else. Some people believe that the best way to 'get through life' is by being the best you can be at several somethings, even if you are not the absolute best. And so on.

    The problem with small business owners is that they, in this instance, are running on the basis of some dime-store logic, and not the full diamond. "You need to look to cut costs everywhere" which has a corollary in the form of "You need to understand your art / business / science well enough to know when you are cutting costs, and when you are screwing yourself long-term." Unfortunately, this is typically lost on small-business owners, since they think that in order to get ahead of the game, they need to rush people / everything, because "time is money"; what is actually happening here is a programmer is trying to explain to them why what they are thinking about doing is going to cost them tens to hundreds of thousands of dollars, but their attention span won't allow them to spend five minutes to save themselves that money. Being the head of a small-business somehow leads one to believe that you need to act like every bad CEO / president / actor on TV you've ever seen, which means asking for bullet points and never seeming interested in the details.

    WordPress is fine if you are running a blog. It's fine if you have a dedicated programmer on staff, and you are running a company that sells t-shirts with funny slogans over the internet. It can't be hacked into a better product...it doesn't work like that. If you aren't selling t-shirts, consider something else. Everyone will offer their favorite flavor of the month CMS (which, in common parlance, can be seen as a website that lets you add most new products / adjust prices without needing to hassle a programmer); many of them suck, and popular does not mean good. Do some research, see how much it would cost for a mid-range developer (look at the high-end of the reported salaries...those sites tend to lie) to know what it will look like if your website needs to be pulled out of the fire (manually); hopefully that will never happen...you'll open up a decent relationship with a good firm, choose the right CMS, and never have to worry about Plan B. Plan B, in case you are unawares, is when that firm disappears for whatever reason, and leaves you with a website that you need updated, but no one else is familiar with, but you absolutely, positively need someone to fix it, because otherwise your business is sunk.

    --
    I am John Hurt.
  13. Re:In case you were wondering... by The+Cat · · Score: 2

    HTML is dogshit. CSS is catshit. Together they make two-tone shitty shit with a shit chaser.