Hướng dẫn vá lỗ hổng DoS trên WordPress - CVE-2018-6389

[whf]

Như WhiteHat đã đưa tin về Lỗ hổng DoS khiến bất cứ ai cũng có thể đánh sập các website WordPress đây là một lỗ hỗng được đánh giá là nghiêm trọng nhưng lại rất dễ tấn công. Để vá lỗ hổng này các bạn có thể làm theo cách sau:

Cách 1. Tải bash file wpdospatch.sh ở cuối bài và chạy để vá nếu bạn dùng linux:

wpdospatch.sh

if [[ -f wp-login.php && -f wp-admin/load-scripts.php && -f wp-admin/includes/noop.php ]]
then
        sed -i "1 s/^.*$/<?php\ndefine('CONCATENATE_SCRIPTS', false);/" wp-login.php
        sed -i -e "s/^require( ABSPATH . WPINC . '\/script-loader.php' );$/require( ABSPATH . 'wp-admin\/admin.php' );/g" wp-admin/load-scripts.php
        sed -i -e "s/^require( ABSPATH . WPINC . '\/script-loader.php' );$/require( ABSPATH . 'wp-admin\/admin.php' );/g" wp-admin/load-styles.php
        echo """<?php
/**
* Noop functions for load-scripts.php and load-styles.php.
*
* @package WordPress
* @subpackage Administration
* @since 4.4.0
*/

function get_file( \$path ) {
        if ( function_exists('realpath') ) {
                \$path = realpath( \$path );
        }
        if ( ! \$path || ! @is_file( \$path ) ) {
                return '';
        }
        return @file_get_contents( \$path );   
}""" > wp-admin/includes/noop.php
        echo 'Successfuly patched.'
else
        echo 'Please run this file from WordPress root directory.'
fi

Cách 2:

1. Tải file wpdospatch.php ơ cuối bài và up lên thư mục gốc WordPress
2. Truy cập vào http://webcuaban.com/wpdospatch.php
3. Xóa file wpdospatch.php

wpdospatch.php

<?php

if(is_file('wp-login.php') && is_file('wp-admin/load-scripts.php') && is_file('wp-admin/load-styles.php') && is_file('wp-admin/includes/noop.php')) {
    
    $wp_login_lines = explode("\n",file_get_contents('wp-login.php'));
    $wp_login_is_ok = ($wp_login_lines[1] == "define('CONCATENATE_SCRIPTS', false);");
    
    $load_styles_is_ok = strpos(file_get_contents('wp-admin/load-styles.php'),"require( ABSPATH . 'wp-admin/admin.php' );") !== false;
    $load_scripts_is_ok = strpos(file_get_contents('wp-admin/load-scripts.php'),"require( ABSPATH . 'wp-admin/admin.php' );") !== false;
    
    $noop_content = "<?php
    /**
    * Noop functions for load-scripts.php and load-styles.php.
    *
    * @package WordPress
    * @subpackage Administration
    * @since 4.4.0
    */
    function get_file( \$path ) {
            if ( function_exists('realpath') ) {
                    \$path = realpath( \$path );
            }
            if ( ! \$path || ! @is_file( \$path ) ) {
                    return '';
            }
            return @file_get_contents( \$path );   
    }
    ";
    
    $noop_is_ok = file_get_contents('wp-admin/includes/noop.php') == $noop_content;
    
    
    if($wp_login_is_ok) {
        echo "wp-login.php ok\n<br>";
    } else {
        $wp_login_lines[0] = "<?php\ndefine('CONCATENATE_SCRIPTS', false);";
        file_put_contents('wp-login.php',implode(PHP_EOL,$wp_login_lines));
        echo "wp-login.php patched\n<br>";
    }
    
    if($load_styles_is_ok) {
        echo "wp-admin/load-styles.php ok\n<br>";
    } else {
        file_put_contents('wp-admin/load-styles.php',str_replace("require( ABSPATH . WPINC . '/script-loader.php' );","require( ABSPATH . 'wp-admin/admin.php' );",file_get_contents('wp-admin/load-styles.php')));
        echo "wp-admin/load-styles.php patched\n<br>";
    }
    
    if($load_scripts_is_ok) {
        echo "wp-admin/load-scripts.php ok\n<br>";
    } else {
        file_put_contents('wp-admin/load-scripts.php',str_replace("require( ABSPATH . WPINC . '/script-loader.php' );","require( ABSPATH . 'wp-admin/admin.php' );",file_get_contents('wp-admin/load-scripts.php')));
        echo "wp-admin/load-scripts.php patched\n<br>";
    }
    
    if($noop_is_ok) {
        echo "wp-admin/includes/noop.php ok\n<br>";
    } else {
        file_put_contents('wp-admin/includes/noop.php',$noop_content);
        echo "wp-admin/includes/noop.php patched\n<br>";
    }
}