From c2cdf97bee188a94c4e2e64608b84cc0f72337d4 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Mon, 21 Jan 2013 22:00:09 +0100 Subject: [PATCH] added XSD checking for XML files --- data/plugin_vulns.xml | 70 +++++------------ data/theme_vulns.xml | 40 +++++----- data/vuln.xsd | 60 +++++++++++++++ data/wp_vulns.xml | 167 ++++++++++++++++++++++++++++------------ lib/common_helper.rb | 1 + spec/xml_checks_spec.rb | 19 ++++- 6 files changed, 234 insertions(+), 123 deletions(-) create mode 100644 data/vuln.xsd diff --git a/data/plugin_vulns.xml b/data/plugin_vulns.xml index 371fb334..ed0c334d 100644 --- a/data/plugin_vulns.xml +++ b/data/plugin_vulns.xml @@ -1,40 +1,25 @@ - + + @@ -1459,8 +1444,6 @@ File Upload Vulnerability AllWebMenus 1.1.3 Remote File Inclusion http://www.exploit-db.com/exploits/17861/ RFI - /wp-content/plugins/allwebmenus-wordpress-menu-plugin/actions.php - abspath=XXpathXX @@ -2087,7 +2070,6 @@ File Upload Vulnerability DM Albums 1.9.2 Remote File Inclusion Vuln http://www.exploit-db.com/exploits/9043/ RFI - /wp-content/plugins/dm-albums/template/album.php?SECURITY_FILE=XXpathXX @@ -2286,10 +2268,9 @@ File Upload Vulnerability - BackUp<= 0.4.2b RFI Vulnerability + BackUp <= 0.4.2b RFI Vulnerability http://www.exploit-db.com/exploits/4593/ RFI - /wp-content/plugins/BackUp/Archive.php?bkpwp_plugin_path=XXpathXX @@ -2298,7 +2279,6 @@ File Upload Vulnerability plugin myflash <= 1.00 (wppath) RFI Vulnerability http://www.exploit-db.com/exploits/3828/ RFI - /wp-content/plugins/myflash/myflash-button.php?wpPATH=XXpathXX @@ -2307,7 +2287,6 @@ File Upload Vulnerability plugin wordTube <= 1.43 (wpPATH) RFI Vulnerability http://www.exploit-db.com/exploits/3825/ RFI - /wp-content/plugins/wordtube/wordtube-button.php?wpPATH=XXpathXX @@ -2316,7 +2295,6 @@ File Upload Vulnerability plugin wp-Table <= 1.43 (inc_dir) RFI Vulnerability http://www.exploit-db.com/exploits/3824/ RFI - /wp-content/plugins/wp-table/js/wptable-button.phpp?wpPATH=XXpathXX @@ -2325,7 +2303,6 @@ File Upload Vulnerability myGallery <= 1.4b4 Remote File Inclusion Vulnerability http://www.exploit-db.com/exploits/3814/ RFI - /mygallery/myfunctions/mygallerybrowser.php?myPath=XXpathXX @@ -2684,7 +2661,6 @@ File Upload Vulnerability TheCartPress 1.1.1 Remote File Inclusion http://www.exploit-db.com/exploits/17860/ RFI - /wp-content/plugins/thecartpress/checkout/CheckoutEditor.php?tcp_save_fields=true&tcp_class_name=asdf&tcp_class_path=XXpathXX @@ -2693,7 +2669,6 @@ File Upload Vulnerability WPEasyStats 1.8 Remote File Inclusion http://www.exploit-db.com/exploits/17862/ RFI - /wp-content/plugins/wpeasystats/export.php?homep=XXpathXX @@ -2702,7 +2677,6 @@ File Upload Vulnerability Annonces 1.2.0.0 Remote File Inclusion http://www.exploit-db.com/exploits/17863/ RFI - /wp-content/plugins/annonces/includes/lib/photo/uploadPhoto.php?abspath=XXpathXX @@ -2711,8 +2685,6 @@ File Upload Vulnerability Livesig 0.4 Remote File Inclusion http://www.exploit-db.com/exploits/17864/ RFI - /wp-content/plugins/livesig/livesig-ajax-backend.php - wp-root=XXpathXX&action=asdf @@ -2721,7 +2693,6 @@ File Upload Vulnerability Disclosure Policy 1.0 Remote File Inclusion http://www.exploit-db.com/exploits/17865/ RFI - /wp-content/plugins/disclosure-policy-plugin/functions/action.php?delete=asdf&blogUrl=asdf&abspath=XXpathXX @@ -2730,7 +2701,6 @@ File Upload Vulnerability Mailing List 1.3.2 Remote File Inclusion http://www.exploit-db.com/exploits/17866/ RFI - /wp-content/plugins/mailz/lists/config/config.php?wpabspath=XXpathXX Mailing List < 1.4.1 Arbitrary file download @@ -2744,7 +2714,6 @@ File Upload Vulnerability Zingiri Web Shop 2.2.0 Remote File Inclusion http://www.exploit-db.com/exploits/17867/ RFI - /wp-content/plugins/g-web-shop/fws/ajax/init.inc.php?wpabspath=XXpathXX Zingiri Web Shop <= 2.2.3 Remote Code Execution @@ -2771,7 +2740,6 @@ File Upload Vulnerability Relocate Upload 0.14 Remote File Inclusion http://www.exploit-db.com/exploits/17869/ RFI - /wp-content/plugins/relocate-upload/relocate-upload.php?ru_folder=asdf&abspath=XXpathXX diff --git a/data/theme_vulns.xml b/data/theme_vulns.xml index 7c4529cc..88144c58 100644 --- a/data/theme_vulns.xml +++ b/data/theme_vulns.xml @@ -1,27 +1,25 @@ - + + @@ -1172,4 +1170,4 @@ along with this program. If not, see . - + diff --git a/data/vuln.xsd b/data/vuln.xsd new file mode 100644 index 00000000..8178dcc1 --- /dev/null +++ b/data/vuln.xsd @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/data/wp_vulns.xml b/data/wp_vulns.xml index 244f0c5a..13408bda 100644 --- a/data/wp_vulns.xml +++ b/data/wp_vulns.xml @@ -1,37 +1,36 @@ - + + - + + XMLRPC Pingback API Internal/External Port Scanning https://github.com/FireFart/WordpressPingbackPortScanner + UNKNOWN WordPress XMLRPC pingback additional issues http://lab.onsec.ru/2013/01/wordpress-xmlrpc-pingback-additional.html + UNKNOWN @@ -39,6 +38,7 @@ This file contains vulnerabilities associated with WordPress verions. WordPress 3.4.2 Cross Site Request Forgery http://packetstormsecurity.org/files/116785/WordPress-3.4.2-Cross-Site-Request-Forgery.html + CSRF @@ -46,6 +46,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 3.3.1 Multiple CSRF Vulnerabilities http://www.exploit-db.com/exploits/18791/ + CSRF @@ -53,10 +54,12 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 3.3.1 Multiple CSRF Vulnerabilities http://www.exploit-db.com/exploits/18791/ - - + CSRF + + WordPress 3.3.2 Cross Site Scripting http://packetstormsecurity.org/files/113254 + XSS @@ -64,14 +67,17 @@ This file contains vulnerabilities associated with WordPress verions. Multiple vulnerabilities including XSS and Privilege Escalation http://wordpress.org/news/2012/04/wordpress-3-3-2/ + MULTI Wordpress 3.3.1 Multiple CSRF Vulnerabilities http://www.exploit-db.com/exploits/18791/ + CSRF - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -79,31 +85,36 @@ This file contains vulnerabilities associated with WordPress verions. Reflected Cross-Site Scripting in WordPress 3.3 http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -111,10 +122,12 @@ This file contains vulnerabilities associated with WordPress verions. Multiple SQL Injection Vulnerabilities http://www.exploit-db.com/exploits/17465/ + SQLI XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -122,10 +135,12 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 3.1.2 Clickjacking Vulnerability http://seclists.org/fulldisclosure/2011/Sep/219 + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -133,38 +148,44 @@ This file contains vulnerabilities associated with WordPress verions. WordPress wp-includes/formatting.php make_clickable() PCRE Library Remote DoS http://osvdb.org/show/osvdb/72142 + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -172,14 +193,17 @@ This file contains vulnerabilities associated with WordPress verions. SQL injection vulnerability in do_trackbacks() Wordpress function http://www.exploit-db.com/exploits/15684/ + SQLI Wordpress 3.0.3 stored XSS IE7,6 NS8.1 http://www.exploit-db.com/exploits/15858/ + XSS XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -187,42 +211,49 @@ This file contains vulnerabilities associated with WordPress verions. WordPress XML-RPC Interface Access Restriction Bypass http://osvdb.org/69761 + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + WordPress: Information Disclosure via SQL Injection Attack http://blog.sjinks.pro/wordpress/858-information-disclosure-via-sql-injection-attack/ + SQLI XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -230,21 +261,25 @@ This file contains vulnerabilities associated with WordPress verions. WordPress 2.9 Failure to Restrict URL Access http://www.exploit-db.com/exploits/11441/ + UNKNOWN Wordpress DOS <= 2.9 http://www.exploit-db.com/exploits/11441/ + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -252,17 +287,20 @@ This file contains vulnerabilities associated with WordPress verions. WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution http://www.exploit-db.com/exploits/10089/ + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -270,10 +308,12 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 2.8.3 Remote Admin Reset Password Vulnerability http://www.exploit-db.com/exploits/9410/ + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -281,17 +321,20 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 2.8.1 (url) Remote Cross Site Scripting Exploit http://www.exploit-db.com/exploits/9250/ + XSS XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - - + + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -299,24 +342,28 @@ This file contains vulnerabilities associated with WordPress verions. WordPress 2.0 - 2.7.1 admin.php Module Configuration Security Bypass Vulnerability http://www.exploit-db.com/exploits/10088/ + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -324,20 +371,23 @@ This file contains vulnerabilities associated with WordPress verions. XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -345,31 +395,36 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 2.6.1 (SQL Column Truncation) Admin Takeover Exploit http://www.exploit-db.com/exploits/6421/ + UNKNOWN XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS - + XSS vulnerability in swfupload in WordPress http://seclists.org/fulldisclosure/2012/Nov/51 + XSS @@ -377,6 +432,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 2.3.1 Charset Remote SQL Injection Vulnerability http://www.exploit-db.com/exploits/4721/ + SQLI @@ -384,10 +440,12 @@ This file contains vulnerabilities associated with WordPress verions. WordPress 2.2 (wp-app.php) Arbitrary File Upload Exploit http://www.exploit-db.com/exploits/4113/ + UNKNOWN Wordpress 2.2 (xmlrpc.php) Remote SQL Injection Exploit http://www.exploit-db.com/exploits/4039/ + SQLI @@ -395,6 +453,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 2.1.3 admin-ajax.php SQL Injection Blind Fishing Exploit http://www.exploit-db.com/exploits/3960/ + SQLI @@ -402,6 +461,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit http://www.exploit-db.com/exploits/3656/ + SQLI @@ -409,6 +469,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 2.0.6 wp-trackback.php Remote SQL Injection Exploit http://www.exploit-db.com/exploits/3109/ + SQLI @@ -416,6 +477,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress 2.0.5 Trackback UTF-7 Remote SQL Injection Exploit http://www.exploit-db.com/exploits/3095/ + SQLI @@ -423,6 +485,7 @@ This file contains vulnerabilities associated with WordPress verions. WordPress <= 2.0.2 (cache) Remote Shell Injection Exploit http://www.exploit-db.com/exploits/6/ + UNKNOWN @@ -430,6 +493,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 1.5.1.3 Remote Code Execution eXploit (metasploit) http://www.exploit-db.com/exploits/1145/ + SQLI @@ -437,6 +501,7 @@ This file contains vulnerabilities associated with WordPress verions. Wordpress <= 1.5.1.2 xmlrpc Interface SQL Injection Exploit http://www.exploit-db.com/exploits/1077/ + SQLI @@ -444,10 +509,12 @@ This file contains vulnerabilities associated with WordPress verions. WordPress <= 1.5.1.1 "add new admin" SQL Injection Exploit http://www.exploit-db.com/exploits/1059/ + SQLI - WordPress <= 1.5.1.1 SQL Injection Exploit + WordPress <= 1.5.1.1 SQL Injection Exploit http://www.exploit-db.com/exploits/1033/ + SQLI diff --git a/lib/common_helper.rb b/lib/common_helper.rb index 5bd547c7..5849f4d8 100644 --- a/lib/common_helper.rb +++ b/lib/common_helper.rb @@ -39,6 +39,7 @@ THEMES_FILE = DATA_DIR + "/themes.txt" THEMES_FULL_FILE = DATA_DIR + "/themes_full.txt" THEMES_VULNS_FILE = DATA_DIR + "/theme_vulns.xml" WP_VULNS_FILE = DATA_DIR + "/wp_vulns.xml" +VULNS_XSD = DATA_DIR + "/vuln.xsd" WPSCAN_VERSION = "2.0" diff --git a/spec/xml_checks_spec.rb b/spec/xml_checks_spec.rb index ed5c25d7..59d3612a 100644 --- a/spec/xml_checks_spec.rb +++ b/spec/xml_checks_spec.rb @@ -25,27 +25,44 @@ describe "XML checks" do FileTest.exists?(full_path).should be_true - expect { Nokogiri::XML(File.read(full_path)) { |config| config.strict } }.to_not raise_error + if @xsd + xsd = Nokogiri::XML::Schema(File.read(@xsd)) + doc = Nokogiri::XML(File.read(full_path)) + + errors = [] + xsd.validate(doc).each do |error| + errors << error.message + end + + errors.should === [] + else + expect { Nokogiri::XML(File.read(full_path)) { |config| config.strict } }.to_not raise_error + end end it "check plugin_vulns.xml for syntax errors" do @file = "plugin_vulns.xml" + @xsd = VULNS_XSD end it "check theme_vulns.xml for syntax errors" do @file = "theme_vulns.xml" + @xsd = VULNS_XSD end it "check wp_versions.xml for syntax errors" do @file = "wp_versions.xml" + @xsd = nil end it "check wp_vulns.xml for syntax errors" do @file = "wp_vulns.xml" + @xsd = VULNS_XSD end it "check local_vulnerable_files.xml for syntax errors" do @file = "local_vulnerable_files.xml" + @xsd = nil end end \ No newline at end of file