Zero-day Vulnerability In TimThumb Image Utility Threatens Many WordPress Sites

Use Netsparker


This is pretty apt after we wrote about WebsiteDefender – Ensure Your Website Security on Monday, a platform for securing web applications with a focus on WordPress. Today a zero-day in a very commonly used WordPress library hit quite a few news sites.

The flaw is in an image utility called TimThumb which is used in a LOT of premium themes for generating on the fly thumbnails, you can check it out (and grab the latest version) here:

http://code.google.com/p/timthumb/

Attackers are exploiting a widely used extension for the WordPress publishing platform to take control of vulnerable websites, one of the victims has warned.

The vulnerability affects virtually all websites that have an image-resizing utility called TimThumb running with WordPress, Mark Maunder, CEO of Seattle-based Feedjit, wrote in a post published Monday. The extension is “inherently insecure” because it makes it easy for hackers to execute malicious code on websites that use it. At least two websites have already been compromised, he reported.

Maunder said he found the vulnerability after discovering his own website, markmaunder.com, was suddenly and inexplicably loading advertisements, even though the blog wasn’t configured to do so.

After a thorough investigation, he learned that an attacker had used TimThumb to load a PHP file into one of his site directories and then execute it. The utility, he said, by default allows files to be remotely loaded and resized from blogger.com, wordpress.com, and five other websites and doesn’t vet URLs for malicious strings, making it possible to upload malicious payloads.

I personally think this could cause some major problems because TimThumb is bundled with almost every WordPress theme (free ones or otherwise) and is invariably an old version – which will be insecure. It creates an image cache inside the readable webroot – which is really bad.

Plus the URL filtering doesn’t really work properly, so with your own domain you could create a subdomain malware.flickr.com.darknet.org.uk/malware.php and host up some nasty files there, call TimThumb on that file and it’d be cached in the webroot.


“So if you create a file on a web server like so: http://blogger.com.somebadhackersite.com/badscript.php and tell timthumb.php to fetch it, it merrily fetches the file and puts it in the cache directory ready for execution,” Maunder explained.

He went on to report the technique was used on Friday to hack Ben Gillbanks, developer of TimThumb. Gilders is working on a permanent fix, but in the meantime, Maunder has submitted a temporary patch that fixes the most obvious errors.

“I can’t apologise enough for this oversight in the code and hope nobody has anything too bad happen to their sites because of my error,” Gilders wrote in a comment responding to Maunder’s post

One of the first people that was hit was a WordPress developer himself (which is a good thing as it means we get a quick fix), a new more secure version (hopefully) is in the works and the developer has pushed out some quick fixes in the current version to make it harder to exploit.

You can grab the latest TimThumb.php code here:

http://timthumb.googlecode.com/svn/trunk/timthumb.php

There are also a lot more details on how to fix the problem on Mark Maunder’s blog, CEO of Seattle-based Feedjit:

Zero Day Vulnerability in Many WordPress Themes

There’s a story from Network World here too:

Zero-day vulnerability found in a WordPress image utility

TimThumb is in many themes with other names, so please also search for thumb.php, cropper.php, crop.php & resize.php.

Site: The Register

Posted in: Exploits/Vulnerabilities, Web Hacking

, , , ,


Latest Posts:


Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.


6 Responses to Zero-day Vulnerability In TimThumb Image Utility Threatens Many WordPress Sites

  1. clyang August 3, 2011 at 12:59 pm #

    One quick way to identify where timthumb located:
    1. ssh into your server
    2. go to WordPress’s root directory
    3. use the following command: find . -name “*.php” -exec grep -H TimThumb {} \;

    Then, replace all founded file to latest version.

    • Bogwitch August 3, 2011 at 1:32 pm #

      As Darknet said, there are many instances where TimThumb is renamed so just performing a ‘find’ for TimThumb may not be sufficient.
      Far better that you actually know which modules are installed as part of your wordpress installation!

      • clyang August 3, 2011 at 1:45 pm #

        The method I used is to find all php files which contain the string “TimThumb”. It’s not just finding by filename :)

        Oops, let me do a minor fix with my command to make it more accurate. Please use the following command: find . -name “*.php” -exec grep -H ‘TimThumb script created by Ben’ {} \;

  2. Bogwitch August 3, 2011 at 4:09 pm #

    I should learn to read the code fully!

  3. droope August 3, 2011 at 6:00 pm #

    so interesting :)

  4. dilan August 6, 2011 at 11:23 am #

    should be search the exploit on exploit database, if any :D