[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-disclosure] A question for the list - WordPress plugin inspections

Hi Jerome,

The criteria are here:

https://security.dxw.com/about/plugin-inspections/

Is that what you mean?
I agree using a common classification would be good. I'll have a look into that.
As mentioned before, though - these are not vulnerability reports. We do those too: 

https://security.dxw.com/advisories/xss-and-csrf-in-user-domain-whitelist-v1-4/
and they are more detailed. Inspections are more about code smell, if you know what I mean. So there aren't specific files, lines, etc. 

Harry


On 20/02/2014 08:39, Jerome Athias wrote:

It is valuable
I concur (# line of code, file names and CVE submission).

I would also suggest to use common classifications (or a mapping) such
as OWASP TOP10, WASC, CWE (CAPEC) for your criterias.

Providing details regarding the methodology or/and tools used for the
assessment would be also valuable.
(i.e. Checklist, RIPS,
https://labs.portcullis.co.uk/tools/wordpress-build-review-tool/ )

Thank you
Best regards

2014-02-19 Seth Arnold <seth.arnold@xxxxxxxxxxxxx>:

On Wed, Feb 19, 2014 at 06:40:51PM +0000, Harry Metcalfe wrote:

We write and publish light-touch inspections of WordPress plugins
that we do for our clients. They are just a guide - we conduct some
basic checks, not a thorough review.

Would plugins which fail this inspection be of general interest to
the list and therefore worth posting, as we would a vulnerability?

Here's an example report:

   https://security.dxw.com/plugins/gd-star-rating-1-9-22/

Grateful for a steer...

That's a very nice summary view, but it'd be more useful in this medium
if you included the lines of code that introduce the vulnerabilities.

Most useful would be to coordinate with authors and MITRE for CVE numbers
for the issues you find to ensure the issues aren't forgotten about or
otherwise ignored.

Thanks

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/