Prepare(): Introducing Novel Exploitation Techniques in Wordpress
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 11:00· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
WordPress powers ~30% of sites and WooCommerce has ~2.3M installs so a core design choice matters: a custom prepared-statement layer enables a double prepare SQL injection (patched by replacing % with a 66 character random string), and caching serialized WP_Query objects enables a crafted mismatch of string lengths that becomes a PHP object injection leading to authenticated (and in some plugins unauthenticated) remote code execution; demos show exploitation working end to end.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:42About me
- 1:24What is WordPress
- 2:30Installing Plugins
- 3:12Overview
- 3:41Background
- 4:44Medicals
- 5:27Custom Prepared Statements
- 7:05Exploit Technique 1
- 10:09Exploit Technique 2 Demonstration
- 10:56WordPress Patch
- 12:42Second Exploit Technique
- 15:10Recap
- 16:47Exploit 2 WooCommerce
- 22:41Exploit 6 Wordpress
- 25:23Closing Words
- 26:19Question
- 26:56How it works
- 27:42What the attacker does
- 28:58WordPress version
- 29:34Advice to plugin authors
- 30:57Will there be a prepared statement
- 32:00Is there a safe way to use that caching technique
- 32:48How have you found the experience working with different plugin teams
related talks
36mHow the WordPress Ecosystem Handles Security and What You Can Learn from It
01h 02mHacking Wordpress, a Crash Course in Writing Plugins and Widgets
43mI Had WordPress, but It Got Hacked
44mI've Been Hacked, Now What
27mSecuring your WordPress sites
40mHow to hack a node app?
44mEnding Injection Vulnerabilities
22mSecure Your Code — Injections and Logging