Some Wordpress Plugin Stuff

[Scott Arciszewski <scott () arciszewski me>]

Hi OSS Sec,

I took a quick glance through some Wordpress plugins tagged with security.
I don't imagine anyone would be surprised that I found vulnerabilities.

-------------------------------

SecurityMoz Security Audit

https://wordpress.org/plugins/securemoz-security-audit/

file_get_contents() + explicitly HTTP (no TLS) -> unserialize()

-------------------------------

WP Limit Login Attempts

https://wordpress.org/plugins/wp-limit-login-attempts/

Trivial SQL injection via HTTP headers.

     $ip = getip();
     $tablename = $wpdb->prefix."limit_login";
     $tablerows = $wpdb->get_results( "SELECT `login_id`,
`login_ip`,`login_attempts`,`attempt_time`,`locked_time` FROM  `$tablename`
  WHERE `login_ip` =  '$ip'  ORDER BY `login_id` DESC LIMIT 1 " );

     // ~8<~8<~8<~8<~8<~8<~8<~8<~

    function getip(){
           if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
            $ip = $_SERVER['HTTP_CLIENT_IP'];
        } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
            $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
        } else {
            $ip = $_SERVER['REMOTE_ADDR'];
             if($ip=='::1'){
                 $ip = '127.0.0.1';
             }
        }
        return $ip;
    }

-------------------------------

I'm not sure if it's even worth assigning a CVE to any of these. Maybe the
SQLi one? I leave that decision in MITRE's capable hands.

Also, Tor Blocker (link below) uses HTTP to grab the list of IP addresses
to block. It's telling and appropriate that the person who developed a
plugin to oppose a privacy technology would fail to use TLS.

https://wordpress.org/plugins/tor-exit-nodes-blocker/

(Surely no one would ever think to hack an upstream router and MitM the
connection to block the blog administrator from their own blog or allow Tor
nodes through!)

That's all from me. I might keep poking at some of the fatter plugins to
see what I can find.

Scott Arciszewski