Enero 20th, 2008   

Captcha Unsafe?

I’ve recently received an email asking me to fix some Captcha! vulnerabilities that will allow spammers to enter automated spam comments. Such supposed vulnerabilities where published on a Russian Ukranian blog.

Puzzled about this, I checked those post. One of them claimed Captcha! is vulnerable to CSRF and the other post is about XSS.

Basically, CSRF means you visit an insecure website while logged in into our Wordpress blog. If so, and the site is prepared specifically for you (that is, the hacker knows you’re going to browse him while being logged into xxyyzz.com and your’re the admin of xxyyzz.com) then he could create a malicious page to change your WP configuration (Captcha! included) awaiting for you to browse it.

Using this (rather improbable and really tricky) technique, visiting a hackers site can change Captcha! code length to 0, which disables it: Captcha! won’t check 0-length codes. The sames applies for XSS (the second vulnerability).

Protecting against CSRF

This has been fixed on version 2.6 (now avaliable for download).

For previous versions, the best protection against CSRF is to logout your WP site before browsing an insecure web site. If you tend to check the “Remember me” check box when logging in, don’t use it.

Also use a browser like Firefox with the NoScript! extension installed. This extension will warn you about this kinds of attacks even if you have forgotten to logout your WP blog.

How will this impact me?

You can relax. There’s nothing dangerous to fix, and Captcha! is safe. Simply ugprade to the latest version.

Comparte el artículo:These icons link to social bookmark sites which allow other readers to discover and share new webs and posts.

• 
• 
• 
• 

Posted by Boriel as Wordpress, Security

Rate This Post:

(1 votes, average: 3 out of 5)

 

This entry was posted at 5.22 pm and is filed under Wordpress, Security. You can follow any responses to this entry through the comments RSS 2.0 feed. You can leave a response, or trackback from your own site.

4 Responses to “Captcha Unsafe?”

1. MustLive says:
   

   Hello Boriel.

   It’s good that you fixed these holes. Always attend to security of all of yours web sites and web applications.

   And my site is Ukrainian blog ;-).

   Enero 21st, 2008 at 10.13 pm
2. R_de_Rumba says:
   

   Buenas, estaba buscando solucion a un hackeo que me han hecho a mi blog y me gustaria saber si podrias ayudarme un poco con esta movida.

   Ha sido hackeado por un gilipollas y me gustaria saber que hacer para arreglarlo ya que ha cambiado la cuenta de administrador.

   Si lo deseas, puedes responderme por mail.

   Eternamente agradecido.

   Enero 23rd, 2008 at 2.21 pm
3. Boriel says:
   

   R_de_Rumba:

   Siento lo que te ha pasado. He visto el “defacing”, pero he tenido que
   ir a clases de doctorado.
   Acabo de llegar a casa. Veo que tu blog ya está restaurado.

   Es probable que hayas sido víctima de un “SQL injection”, que había en
   WP 2.3.1, o puede que te hayan hecho lo del ataque XSS, pero lo veo
   improbable.

   Así que no creo que sea cosa tuya ni de Captcha! Supongo que ya lo
   habrán corregido los administradores de tu hosting. Si eres tú quien
   instala tu propio WP, ponte siempre que puedas la última versión, y
   estate atendo al DashBoard (Tablón de Anuncios del panel de
   administración) pues anuncian los parches y actualizaciones que van
   saliendo.

   Enero 23rd, 2008 at 9.15 pm
4. Sai says:
   

   Hi, I just got hooked to ur captcha module and it worked wonderful till I enable Google analytics plugin of wordpress, Ultimate Google Analytics.
   Any idea why UGA is spoiling captcha module?

   Thanks for ur time..

   Febrero 29th, 2008 at 7.03 am

Leave a Reply

Copyright © 2008, El Rincón de Boriel | Theme by Boriel. Based on design by haran
and converted by John Hesch.