From d9b86f9922be554748602df8bd6201a21f7fd611 Mon Sep 17 00:00:00 2001 From: erwanlr Date: Wed, 2 Jul 2014 12:17:14 +0200 Subject: [PATCH] Fix Timthumb RCE detection for version 2.0 (which was excluded) --- lib/common/models/wp_timthumb/vulnerable.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/common/models/wp_timthumb/vulnerable.rb b/lib/common/models/wp_timthumb/vulnerable.rb index 0f8261a5..1719d0bc 100644 --- a/lib/common/models/wp_timthumb/vulnerable.rb +++ b/lib/common/models/wp_timthumb/vulnerable.rb @@ -18,9 +18,9 @@ class WpTimthumb < WpItem return rce_132_vuln unless VersionCompare.is_newer_or_same?('1.33', version) end - # Vulnerable versions : >= 2.0 and < 2.8.14 + # Vulnerable versions : > 1.35 (or >= 2.0) and < 2.8.14 def check_rce_webshot - return if VersionCompare.is_newer_or_same?('2.8.14', version) || VersionCompare.is_newer_or_same?(version, '2.0') + return if VersionCompare.is_newer_or_same?('2.8.14', version) || VersionCompare.is_newer_or_same?(version, '1.35') response = Browser.get(uri.merge('?webshot=1&src=http://' + default_allowed_domains.sample))