Download to read offline
Uploaded byPrajal Kulkarni
The tale of 100 cve's
The document summarizes Prajal Kulkarni's project to find security vulnerabilities in the WordPress ecosystem. Over a period of a few months, they found over 100 Common Vulnerabilities and Exposures (CVEs) using both manual and automated techniques. Their automated scanning uncovered many cross-site scripting and file inclusion issues. They reported vulnerabilities to developers and plugin maintainers to get issues patched or plugins removed from repositories. Their goal is to improve WordPress security through their CodeVigilant project.
More Related Content
Similar to The tale of 100 cve's
The tale of 100 cve's
- 1. Prajal Kulkarni @prajalkulkarni The Taleof 100 CVE’s
- 2. @about me • SecurityEngineer @Flipkart • Likes to do Bug Hunting! • Loves coding in Python • Member of null security community • Lead vocalist @Sathee @prajalkulkarni
- 3. WordPress SecurityEcosystem! 100 CVE’s in less than a month! How we did it? What Tale?
- 4. 60 Million WebsitesWorldwide Powers 1 in 5 of all the worlds websites in the world -Matt Current stable release 3.9.1 Version 3.8 downloads > 20 Million times -Stats from Wikipedia
- 5.
- 7.
- 8.
- 10. WordPress Core –Stable 3.9.1 31,154 Plugins More than 2.5K Themes Wordpress Security Ecosytem
- 11. Our attempt toImprove the Ecosystem
- 12. Once Upon aTime Credits - Anant Shrivastava
- 13. Wait Something notright!
- 14. Vulnerabilities Found! Full pathdisclosure -pma/error.php -pma/libraries/PMA_List_Database.class.php PHP info disclosure -pma/phpinfo.php Security Bypass Allows direct access. -pma/server_databases.php - Full access to all features including SQL window -pma/main.php – reveals all the details of the database
- 15. Timeliness • Author Contacted:24 July 2013 • No positive response from the author • Wordpress Security Team contacted: 11 September 2013 • Plugin Disabled in the repository : 21 October 2013
- 16.
- 17. Started Project CodeVigilant •Spot new issues in Plugins/Themes • Report to the relevant author • Get the patch released • Else close the Plugin/Theme
- 18.
- 19. Our Approach Download thelatest WordPress and install locally Download all Plugins (31k) Download all Themes (2.5k)
- 20. From Where doI get plugins/themes??
- 21.
- 22.
- 23.
- 24. Started with ManualApproach! Analyze Plugin/Theme source code Understand the logic Find Issues Report !
- 25.
- 26. Two Weeks Stats?? Vulnerability Chart LFI Xss Auth Bypass Using Components With Known Vulnerabilities 10 9 1 1
- 27. Took a Lotof Time!
- 28.
- 29. Started with Crosssite Scripting!
- 31. Simple Logic! Find all$_GET parameters Replace their value with chk_string: '><script>alert(document.cookie)</script> Send the request with the appropriate URL structure Check if the response contains the chk_string
- 32. Guess What! • Morethan 100 valid XSS! • Testing for XSS we also stumbled upon: – SSRF – LFI – Unvalidated Redirects and Forwards
- 33. Stats for thenext 3 weeks! A3-Cross-Site Scripting 211 Unvalidated Redirects and Forwards 4 Local File Inclusion 6 Information Disclosure 1 Direct access & Auth Bypass 1 Using Components with Known Vulnerabilities 30 SSRF/XSPA 4 Injection 9
- 35.
- 36. Future for codevigilant Automationframeworks for other vulnerabilities Explore other platforms like Drupal & Jumla Encourage External Researchers to contribute.
- 37.
- 38.