[jpshare] Wordpress vulnerable to Cross-Site Request Forgery in Connection Information – Not yet fixed with the last Update.
WordPress is a free online Open source content Managed system focused on PHP and MySQL. It is one the powerful and most used blogging tool.
This CSRF issue has been found in Summer of Pwnage hack event which held between July 1-29.
CSRF Vulnerability:
CSRF holds number eight in OWSAP top 10 list.Cross Site Request Forgery is one of the most common forms of attack by online spammers and scammers.
Exploicity of this attack is bit complex, it’s prevalence is common.But CSRF attacks can be predicted easily. Read More about CSRF.
CSRF in WordPress Communication
The FTP/SSH functionality of WordPress was observed to be defenseless to Cross-Site Request Forgery. This weakness can be utilized to overwrite the FTP or SSH association settings of the infected WordPress site.
An assailant can utilize this issue to trap an Administrator into signing into the attacker’s FTP or SSH server, revealing his/her login credentials to the attacker.
In order to exploit this vulnerability, the attacker needs to force a signed on WordPress Administrator into opening a malicious website.
Affected version
This issue was effectively tried on the WordPress from 4.5.3 up till and including version 4.7.4(which is the current version).
Fix
Currently no fix available for this vulnerability with most recent version 4.7.4(released on April 20, 2017).
CSRF Code Analysis with POC
This issue exists in the method request_filesystem_credentials() (/wp-admin/includes/file.php). It allows overwriting of the values:
It allows overwriting of the values:
Also Read:
