WordPress's position is (I think) that usernames aren't secret, and that therefore, username enumeration is a non-problem. I think this is extremely wrong, but it is what it is.
We solve this problem with a plugin that changes the login messages and ensures that invalid usernames will prepopulate the form, as well as valid ones.
We also look for [?|&]a=\d in the URL and remove any matches before the request hits apache, so that attackers can't run through ?a=1, ?a=2 etc looking for redirects to author pages (which include usernames in the URL_.
I've attached the relevant code, but it would need a little work in order to run outside our infrastructure. It is a bit fragile, and would need to be changed if WordPress's login errors changed - currently, there is not a more robust way to do it, as far as we know. Feedback welcome if anyone knows of a better way!
Harry http://security.dxw.com On 04/07/13 14:22, Ivan Carlos wrote:
Can't you open a new bt about this issue? Regards,Em 04/07/2013 10:16, "Sven Kieske" <svenkieske@xxxxxxxxx <mailto:svenkieske@xxxxxxxxx>> escreveu:Hi, the mentioned User account Enumeration Weakness stated in Advisory https://secunia.com/advisories/23621/ still exists in the actual version 3.5.2 . The corresponding trac entry for wordpress is closed as "wontfix": https://core.trac.wordpress.org/ticket/1129 Why? Maybe, because the trac bug mentions just version 1.5 as affected? I can easily reproduce this in version 3.5.2 . Please fix this, this bug is 8 years old! Kind Regards Sven Kieske _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Attachment:
login_errors.class.php
Description: application/php
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/