Feeds

WordPress bug resets admin password

Fixed for now

Boost IT visibility and business value

This story was updated to correct details of the bug. It allows attackers to reset passwords, but not take over accounts.

Developers of the widely used WordPress blogging software have released an update that fixes a vulnerability that let attackers reset the administrator password.

The bug in version 2.8.3 is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required, according to this alert published on the Full-Disclosure mailing list.

The flaw lurks in some of the PHP code that fails to properly scrutinize user input when the password reset feature is invoked. Exploiting it is as easy is directing a web browser to a link that looks something like:

http://domain_name.tld/wp-login.php?action=rp&key[]=

According to WordPress documentation here, the bug has been fixed by changing a single line of code so the program checks to make sure the input supplied for the new password isn't an array. If it is, the user gets an error message and must try again. After this article was first published, version 2.8.4 was released.

That would appear to be the end of it, but security researchers Rafal Los and Mike Bailey wonder aloud here whether it would have made more sense to check instead whether the input is a string.

"Hasty coding?" he asks. "Why take the blacklist vs. whitelist approach?"

After this article was first published, WordPress documentation showed the suggestion from Los and Bailey was being formally adopted.

The bigger point he and other observers seem to make is that PHP is the coding equivalent of an everyman's jet pack. It allows him to quickly soar into the sky with a minimal amount of training but doesn't necessarily provide the means to check for buildings, planes or other hazards that may greet the user once he gets there.

Of course, all languages are only as good as the person using them. But it's worth posing such questions to anything that's standing between your website and the people out to get it.

Additional details and analysis from Sans and Heise here and here. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?