{"id":6378,"date":"2021-10-17T09:08:00","date_gmt":"2021-10-17T09:08:00","guid":{"rendered":"https:\/\/musilda.cz\/?p=6378"},"modified":"2021-10-17T09:08:00","modified_gmt":"2021-10-17T09:08:00","slug":"nekolik-zranitelnosti-v-pluginu-wp-fastest-cache","status":"publish","type":"post","link":"https:\/\/affinite.io\/cs\/nekolik-zranitelnosti-v-pluginu-wp-fastest-cache\/","title":{"rendered":"N\u011bkolik zranitelnost\u00ed v pluginu WP Fastest Cache"},"content":{"rendered":"\n

Zranitelnosti v k\u00f3du plugin\u016f a \u0161ablon se objevuj\u00ed neust\u00e1le. Aktu\u00e1ln\u011b se ale jedn\u00e1 o plugin, kter\u00fd pro zrychlen\u00ed str\u00e1nek pou\u017e\u00edv\u00e1 v\u00edce ne\u017e milion u\u017eivatel\u016f. <\/p>\n\n\n\n

Probl\u00e9m pon\u011bkud m\u00edrn\u00ed to, \u017ee chybu lze vyu\u017e\u00edt pouze, kdy\u017e je na webu aktivn\u00ed i plugin Classic Editor, ale ten m\u00e1 5 milion\u016f aktivn\u00edch instalac\u00ed, tak\u017ee pr\u016fnik bude ve stovk\u00e1ch tis\u00edc. <\/p>\n\n\n\n

V\u0161e spo\u010d\u00edv\u00e1 v tom, \u017ee plugin v metod\u011b set_urls_with_terms vkl\u00e1d\u00e1 do SQL dotazu prom\u011bnnou $id, kter\u00e9 nen\u00ed dostate\u010dn\u011b zkontrolov\u00e1na. <\/p>\n\n\n\n

public static function set_urls_with_terms(){\n        global $wpdb;\n        $terms = $wpdb->get_results(\"SELECT * FROM `\".$wpdb->prefix.\"term_relationships` WHERE `object_id`=\".static::$id, ARRAY_A);\n\n        foreach ($terms as $term_key => $term_val){\n                static::set_term_urls($term_val[\"term_taxonomy_id\"]);\n        }\n}<\/code><\/pre>\n\n\n\n
Statick\u00e1 prom\u011bnn\u00e1 $id, je definov\u00e1na pomoc\u00ed set_id metody:<\/p>\n\n\n\n
public static function set_id(){\n        if(isset($_GET[\"post\"]) && $_GET[\"post\"]){\n                static::$id = esc_sql($_GET[\"post\"]);\n\n                if(get_post_status(static::$id) != \"publish\"){\n                        static::$id = 0;\n                }\n        }\n}<\/code><\/pre>\n\n\n\n
Na prvn\u00ed pohled se m\u016f\u017ee zd\u00e1t, \u017ee program\u00e1tor pou\u017eit\u00edm esc_sql() v\u0161e spr\u00e1vn\u011b vy\u0159e\u0161il, ale bohu\u017eel, funkce pou\u017e\u00edv\u00e1 metodu _escape t\u0159\u00eddy WPDB. <\/p>\n\n\n\n
function esc_sql( $data ) {\n    global $wpdb;\n    return $wpdb->_escape( $data );\n}<\/code><\/pre>\n\n\n\n
Kdy\u017e se pod\u00edv\u00e1te na _escape ve WPDB, zjist\u00edte, \u017ee p\u0159es _real_escape se pro bezpe\u010dnou kontrolu pou\u017e\u00edv\u00e1 mysqli_real_escape_string.<\/p>\n\n\n\n
Bohu\u017eel, to nen\u00ed zcela bezpe\u010dn\u00e9, viz tento koment\u00e1\u0159 na Stack overflow – https:\/\/stackoverflow.com\/questions\/5741187\/sql-injection-that-gets-around-mysql-real-escape-string\/12118602#12118602<\/a><\/p>\n\n\n\n
V podstat\u011b jde o to, \u017ee kdy\u017e do $_GET[‚post‘] po\u0161lete ‚1234 OR 1=1‘, tak get_post_status sice vr\u00e1t\u00ed stav postu pro 1234, ale v $id st\u00e1le z\u016fstane \u0159et\u011bzec a ten se vlo\u017e\u00ed do SQL dotazu v\u00fd\u0161e. <\/p>\n\n\n\n
Proto\u017ee nesm\u00edte d\u016fv\u011b\u0159ovat \u017e\u00e1dn\u00e9mu GET, nebo POST vstupu, m\u011blo by zde b\u00fdt ov\u011b\u0159en\u00ed \u017ee jde o integer. <\/p>\n\n\n\n
JetPack security team, kter\u00fd chybu objevil, ji\u017e autory pluginu kontaktoval a ti vydali verzi 0.9.5, kter\u00e1 obsahuje z\u00e1platu:<\/p>\n\n\n\n
public static function set_id(){\n    if(isset($_GET[\"post\"]) && $_GET[\"post\"]){\n\n        if(preg_match(\"\/\\D+\/\", $_GET[\"post\"])){\n            static::$id = 0;\n        }else{\n            static::$id = esc_sql($_GET[\"post\"]);\n        }\n\n        if(get_post_status(static::$id) != \"publish\"){\n            static::$id = 0;\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
Odkaz na zdroj: https:\/\/jetpack.com\/2021\/10\/14\/multiple-vulnerabilities-in-wp-fastest-cache-plugin\/<\/a><\/p>\n\n\n\n
P.S.:<\/strong> na Facebooku p\u0159i sd\u00edlen\u00ed minul\u00e9ho \u010dl\u00e1nku o n\u011bjak\u00e9 zranitelnosti, kter\u00e1 se projev\u00ed, pouze, kdy\u017e je u\u017eivatel p\u0159ihl\u00e1\u0161en, n\u011bkdo argumentoval t\u00edm, \u017ee kdy\u017e m\u00e1 web, kter\u00fd neumo\u017e\u0148uje p\u0159ihl\u00e1\u0161en\u00ed u\u017eivatel\u016f do adminu, tak je v pohod\u011b. To je pravda jen do doby, ne\u017e se objev\u00ed jin\u00e1 d\u00edra, kter\u00e1 umo\u017en\u00ed registrovat u\u017eivatele, nebo n\u011bkdo prolom\u00ed slab\u00e9 heslo. Tak\u017ee i takov\u00e9 aktualizace, kter\u00e9 se v\u00e1s zd\u00e1nliv\u011b net\u00fdkaj\u00ed jsou d\u016fle\u017eit\u00e9.<\/p>\n\n\n\n
P.S. 2:<\/strong> a tak\u00e9 n\u00e1m podobn\u00e9 \u010dl\u00e1nky ukazuj\u00ed chyby jin\u00fdch, z kter\u00fdch se m\u016f\u017eeme pou\u010dit a ps\u00e1t lep\u0161\u00ed a bezpe\u010dn\u011bj\u0161\u00ed vlastn\u00ed k\u00f3d.<\/p>\n","protected":false},"excerpt":{"rendered":"
Zranitelnosti v k\u00f3du plugin\u016f a \u0161ablon se objevuj\u00ed neust\u00e1le. Aktu\u00e1ln\u011b se ale jedn\u00e1 o plugin, kter\u00fd pro zrychlen\u00ed str\u00e1nek pou\u017e\u00edv\u00e1 v\u00edce ne\u017e milion u\u017eivatel\u016f. Probl\u00e9m pon\u011bkud m\u00edrn\u00ed to, \u017ee chybu lze vyu\u017e\u00edt pouze, kdy\u017e je na webu aktivn\u00ed i plugin Classic Editor, ale ten m\u00e1 5 milion\u016f aktivn\u00edch instalac\u00ed, tak\u017ee pr\u016fnik bude ve stovk\u00e1ch tis\u00edc.<\/p>\n","protected":false},"author":1,"featured_media":9465,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[6],"tags":[],"class_list":["post-6378","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bezpecnost-wordpressu"],"_links":{"self":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts\/6378"}],"collection":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/comments?post=6378"}],"version-history":[{"count":0,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/posts\/6378\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/media\/9465"}],"wp:attachment":[{"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/media?parent=6378"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/categories?post=6378"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/affinite.io\/cs\/wp-json\/wp\/v2\/tags?post=6378"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}