{"id":3161,"date":"2011-08-03T12:02:53","date_gmt":"2011-08-03T11:02:53","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3161"},"modified":"2015-09-09T19:37:09","modified_gmt":"2015-09-09T11:37:09","slug":"zero-day-vulnerability-in-timthumb-image-utility-threatens-many-wordpress-sites","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2011\/08\/zero-day-vulnerability-in-timthumb-image-utility-threatens-many-wordpress-sites\/","title":{"rendered":"Zero-day Vulnerability In TimThumb Image Utility Threatens Many WordPress Sites"},"content":{"rendered":"

This is pretty apt after we wrote about WebsiteDefender \u2013 Ensure Your Website Security<\/a> on Monday, a platform for securing web applications with a focus on WordPress<\/a>. Today a zero-day in a very commonly used WordPress library hit quite a few news sites.<\/p>\n

The flaw is in an image utility called TimThumb which is used in a LOT of premium themes for generating on the fly thumbnails, you can check it out (and grab the latest version) here:<\/p>\n

http:\/\/code.google.com\/p\/timthumb\/<\/a><\/p>\n

Attackers are exploiting a widely used extension for the WordPress publishing platform to take control of vulnerable websites, one of the victims has warned.<\/p>\n

The vulnerability affects virtually all websites that have an image-resizing utility called TimThumb running with WordPress, Mark Maunder, CEO of Seattle-based Feedjit, wrote in a post published Monday. The extension is “inherently insecure” because it makes it easy for hackers to execute malicious code on websites that use it. At least two websites have already been compromised, he reported.<\/p>\n

Maunder said he found the vulnerability after discovering his own website, markmaunder.com, was suddenly and inexplicably loading advertisements, even though the blog wasn’t configured to do so.<\/p>\n

After a thorough investigation, he learned that an attacker had used TimThumb to load a PHP file into one of his site directories and then execute it. The utility, he said, by default allows files to be remotely loaded and resized from blogger.com, wordpress.com, and five other websites and doesn’t vet URLs for malicious strings, making it possible to upload malicious payloads.<\/p><\/blockquote>\n

I personally think this could cause some major problems because TimThumb is bundled with almost every WordPress<\/a> theme (free ones or otherwise) and is invariably an old version – which will be insecure. It creates an image cache inside the readable webroot – which is really bad.<\/p>\n

Plus the URL filtering doesn’t really work properly, so with your own domain you could create a subdomain malware.flickr.com.darknet.org.uk\/malware.php and host up some nasty files there, call TimThumb on that file and it’d be cached in the webroot.<\/p>\n