security for wp4.9.4 : plugin security scanner found something?

  • Hello community,

    On two websites : https://www.nicolaskaragiannis.com and https://www.adp-nuances-chromatiques.com , my plugin ” plugin security scanner” found one vulnerability, that i think is about the new wordpress core update.

    -Here is the message i got in my wp dashboard :

    Vulnerability found: WordPress <= 4.9.4 – Application Denial of Service (DoS) (unpatched) — View details

    Scan completed: 1 vulnerability found.

    -And here is the detail log :

    https://wpvulndb.com/vulnerabilities/9021

    After contacting my webhoster, they told me that for them, after a security scan, all is good. But i am not convinced.

    Could someone exlplain me this log and of course if its dangerous? i still got this warning message from this plugin in my dashboard.
    (I made the wp update 4.9.4 anyway)

    Thanks

    Nico

    The page I need help with: [log in to see the link]

Viewing 11 replies - 1 through 11 (of 11 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    If you’re on 4.9.4, you’re OK. There was — but this is disputed — a “vulnerability” in 4.9.2 that was fixed in 4.9.3.

    Thread Starter nicopointcom

    (@nicopointcom)

    The plugin still show me that the vulnerability (dos) is still here in the 4.9.4

    do you know why?

    thanks

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    You’d have to ask the plugin devs about that.

    @sterndata

    I can’t find the trac ticket for the vulnerability you mentioned in 4.9.2. Is there a ticket?

    Thread Starter nicopointcom

    (@nicopointcom)

    Yeah me too,
    But i found the vulnerability for the 4.9.4 …

    I couldn’t find a reference to a fix for this in the 4.9.3 release notes, but I did find a relevant comment attributed to WordPress Core Security Team Lead @aaroncampbell

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    I guess I’m wrong. the “vulnerability” is still there, but Aaron wrote this:

    Okay, so this is the DoS issue with load-scripts.php and load-styles.php: Basically, the best mitigation for this is at the network level. Hosts and WAFs can rate limit this in a way that makes a lot more sense than anything WordPress can do. Caching would also be extremely useful in this case. Something that we _could_ do is limit the number of scripts that could be loaded at once with those, but the problem with that is all it does is reduce the load by some relatively marginal amount.

    So, there’s the state of that.

    Thread Starter nicopointcom

    (@nicopointcom)

    Drew Mathers :

    yep nice research.

    my webhoster told me the same, with their actuals servors, no problem for this.
    but interesting to realize that maybe this failur is not patched again in the 4.9.4.

    best

    steven :

    yes

    best,

    An unresolved vulnerability report creates a perception of WordPress insecurity among nervous executives, and many users. Site admins using security plugins that subscribe to the WPScan Vulnerability Database will continue to be alerted about this issue.

    If they are not going to mitigate this issue in core, the WordPress Security Team could dispute the vulnerability report.

    I am on 4.9.4 also, and my sitelock report is showing the error: WordPress <= 4.9.4 – Application Denial of Service (DoS)
    An online search brought up a wpcampus.org site that showed a workaround https://wpcampus.org/2018/02/version-4-9-3-version-4-9-4-denial-service-vulnerability/:

    Instead, I would suggest adding a couple of lines to your htaccess file to watch for requests to these file, and block them if the length of the load list is too long.

    RewriteCond %{REQUEST_URI} ^/wp-admin/load-(scripts|styles)\.php$
    RewriteCond %{QUERY_STRING} load(?:\[\])?=(.{256,})$
    RewriteRule ^(.*)$ – [F,L]

    In the full list of scripts, there are 2650 characters. In the above htaccess example, I’ve set it so if there are more than 256 characters forbid the request. You may need to adjust that number upwards if you find your loaded scripts list is longer.

    Has anyone tried this? Does it sound like a good idea?
    all the best,
    Nathalie

    Still not patched. Wow. Disappointed in WP.

Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘security for wp4.9.4 : plugin security scanner found something?’ is closed to new replies.