WordPress 加密问题漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1133107 漏洞类型 信息泄露
发布时间 2017-10-07 更新时间 2019-10-08
CVE编号 CVE-2017-14990 CNNVD-ID CNNVD-201710-425
漏洞平台 N/A CVSS评分 4.0
WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。 WordPress 4.8.2版本中存在安全漏洞,该漏洞源于程序以明文的形式储存wp_signups.activation_key值。远程攻击者可利用该漏洞劫持未激活用户的账户。
Software: WordPress
Version: 4.8.2
Homepage: https://wordpress.org/
Advisory report: https://security.dxw.com/advisories/wordpress-signups-activation/
CVE: CVE-2017-14990
CVSS: 0 (Low; AV:L/AC:H/Au:M/C:N/I:N/A:N)

WordPress does not hash or expire wp_signups.activation_key allowing an attacker with SQL injection to create accounts

When creating new users with a confirmation email, the key for that confirmation email is stored in plain text, and 
never expires. This means that when there are users who have been created who haven’t followed the link in their 
confirmation emails (common in installations with lots of users), an attacker with access to a read-only SQLi 
vulnerability can immediately create a user account for themselves.

wp_users.user_activation_key is hashed and contains a timestamp. wp_signups.activation_key should include these 
security features too.

This issue was originally raised as a ticket in Trac.

Proof of concept

Visit /wp-admin/user-new.php (on a multisite installation – I haven’t tested on single site)
Fill out the “Add New User” form but do not check the “Skip Confirmation Email” checkbox
The user will be sent an email containing a link to /wp-activate.php?key=7259c714857ef009

This key is stored in the database unencrypted and without a timestamp:
mysql> select activation_key from wp_signups where signup_id=4;
| activation_key   |
| 7259c714857ef009 |
1 row in set (0.00 sec)

Regularly purge old entries from the wp_signups table.

Disclosure policy
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: 

Please contact us on security () dxw com to acknowledge this report if you received it via a third party (for example, 
plugins () wordpress org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.


2016-10-24: Opened Trac ticket
2017-10-02: Requested CVE
2017-10-02: Received CVE

Discovered by dxw:
Glyn Wintle
Please visit security.dxw.com for more information.