OWASP WordPress Vulnerability Scanner
WordPress makes up some large percentage of the web. As I’m writing this, web development firms all over the world are churning out WordPress sites for their clients. Some of these installs are vanilla and basic, yet some come with exceedingly complicated plugin/theme combinations. WordPress’ ease of use is a double edged sword. The positive side being a developer may complete a feature rich, member’s only website in one day. The negative being, a multitude of plugins and code snippets written by other developers are included in these projects (other wise they wouldn’t be completed within a day). A good developer will make good choices as to what plugins to use, a novice developer may not be able to tell, and things can become dangerous.
Vulnerabilities to WordPress itself are often handleable via automatic updates. If a client has brought an outdated site to your firm, often best practice is to back up the site in it’s current configuration, update it, and turn updates on from there on out. Plugins and themes can be harder to manage as far as security is concerned, given the nature of developers working on these projects for free, having their own lives, and maybe leaving these projects behind all together.
OWASP WordPress Vulnerability Scanner Project
The Vulnerability Scanner Project is a black box testing script for WordPress installations. A full description can be found on the projects OWASP Wiki.
The scanner is that of a php script checking a multitude of things that you’d otherwise have to check manually. It does this by reading various bits of the sites source to determine core version, theme information, and plugin information which it references with wpvulndb.com’s wordpress vulnerability database. Because this is a black box testing method, it alerts you to things that any visitor to your site may potentially discover. This differs from plugins such as Wordfence, which provide you with insider information (white box). I must disclaim by saying, a script such as this is a valuable tool for a developer to check client’s sites, or their own sites quickly for obvious problems, but keep in mind it’s far from a comprehensive security audit.
Source Code, Installation info, and information about contributing is provided via the WordPress Vulnerability Scanner Project’s GitHub.
Example Time
If you’re a debian user such as myself, you can get the dependencies for this with,
sudo apt-get install php5 php5-cli php5-curl php5-json git
Create a directory to store the wp-scanner code and navigate into it. Then clone the repo,
git clone https://github.com/RamadhanAmizudin/Wordpress-scanner.git
I went ahead to the WordPress Release Archives and downloaded version 4.1.6, which has known issues (just about every old version has issues). For this example, the site is installed on my local machine’s apache server in a directory titled /epm, and there are no other plugins or themes installed on the test site.
Usage of the WordPress Vulnerability Scanner is fairly simple, and for a list of all options just give the -h flag. The example below scans the url localhost/epm with the default settings as defined by the -d flag, and references its findings with the wpvulndb.com as defined by --wpvulndb.
php ./app.php -u localhost/epm -d --wpvulndb
The output for this is such,
+----------------------------------------------------+
| __ __ _ |
| / / /\ \ \___ _ __ __| |_ __ _ __ ___ ___ ___ |
| \ \/ \/ / _ \| '__/ _` | '_ \| '__/ _ \/ __/ __| |
| \ /\ / (_) | | | (_| | |_) | | | __/\__ \__ \ |
| \/ \/ \___/|_| \__,_| .__/|_| \___||___/___/ |
| |_| |
| Vulnerability Scanner v3.0.0 |
+----------------------------------------------------+
[+] Target: http://localhost/epm
[+] Start Time: 06-08-2015 02:03AM
[+] WordPress Version 4.1.6, using Meta Generator method
[+] Finding version vulnerability
[!] WordPress <= 4.2.3 - wp_untrash_post_comments SQL Injection
[+] Fixed in version 3.8.10
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/8126
[*] https://github.com/WordPress/WordPress/commit/70128fe7605cb963a46815cf91b0a5934f70eff5
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2213
[!] WordPress <= 4.2.3 - Timing Side Channel Attack
[+] Fixed in version 4.2.4
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/8130
[*] https://core.trac.wordpress.org/changeset/33536
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5730
[!] WordPress <= 4.2.3 - Widgets Title Cross-Site Scripting (XSS)
[+] Fixed in version 3.8.10
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/8131
[*] https://core.trac.wordpress.org/changeset/33529
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5732
[!] WordPress <= 4.2.3 - Nav Menu Title Cross-Site Scripting (XSS)
[+] Fixed in version 3.8.10
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/8132
[*] https://core.trac.wordpress.org/changeset/33541
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5733
[!] WordPress <= 4.2.3 - Legacy Theme Preview Cross-Site Scripting (XSS)
[+] Fixed in version 3.8.10
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/8133
[*] https://core.trac.wordpress.org/changeset/33549
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5734
[+] WordPress Readme file at http://localhost/epm/readme.html
[+] XML-RPC Interface available under http://localhost/epm/xmlrpc.php
[+] Full Path Disclosure (FPD) available at : http://localhost/epm/wp-includes/rss-functions.php
[+] Target is using twentyfifteen theme
[+] Finding theme vulnerability
[!] Twenty Fifteen Theme <= 1.1 - DOM Cross-Site Scripting (XSS)
[+] Fixed in version 1.2
[+] Reference:
[*] http://wpvulndb.com/vulnerabilities/7965
[*] https://blog.sucuri.net/2015/05/jetpack-and-twentyfifteen-vulnerable-to-dom-based-xss-millions-of-wordpress-websites-affected-millions-of-wordpress-websites-affected.html
[*] http://packetstormsecurity.com/files/131802/
[*] http://seclists.org/fulldisclosure/2015/May/41
[*] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3429
[+] Looking for visible plugins on homepage
[-] No plugin was found
[+] Finish Scan at 06-08-2015 02:03AM
[+] Total time taken is: 1 seconds
ryan@ryan:~/Desktop/Wordpress-scanner-master$
If this were to be a live site, there would be some obvious reasons to be worried.