You are welcome to look around. You will have to register before you can post a message, create a blog, chat live with our members, or add a site to our directory.
The latest version of Wordpress is exploitable by what seems to be an 0day exploit. There is no patch on wordpress.org. Here's the actual exploit: pastebin - collaborative debugging tool
It looks like it's an issue in wp-trackback.php
Temporarily disabling trackbacks should be a work around for now. Nothing has been testing though....
It will loop 10 million times. Imagine if they put usleep(); at a Quarter second to prevent crashing your server, then hitting page over and over for oh about 7 days. You will have a page with 2,419,200 tackback comment on it saying "lol", now imagine having to delete that shit to clean up. Priceless. xD
Hopefully wordpress has some of mechasim to block repeated trackbacks from the same IP...
what the exploit does is tell the server that there's thousands of charsets to convert it to the fix limits the input on the charset value to 50 chars. I tested on my server and it works. 50 might be too much anyways, but it stops the exploit
okay, I think I understand. So wp-trackback accept a Character encoding with a var called $_POST['charset'],
with this code they generate thousands of things saying "UTF-8"
$charset = str_pad($charset,140000,"UTF-8,");
for a payload to mb_convert_encoding, which will loop over then thousands of times. Running up the load on the server.
So I guess checking if $charset is less then 50 might work and is probably too much anways. Must character encodign name will around 10 char right?
Looks good..
Wordpress Exploit
-
Linear Mode
