Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Read an article about Timthumb script being compromised making WP installations vulnerable. Source here

Taking a look at timthumb.php, There is the following function, which I presume is the culprit.

function checkExternal ($src) {

    $allowedSites = array(
        'flickr.com',
        'picasa.com',
        'blogger.com',
        'wordpress.com',
        'img.youtube.com',
    );

Since my site is highly customized (therefore is complicated to update timthumb), would it suffice to delete those external domains as all the images are hosted on my server and hence doesn't require any of the 3rd party domains?

share|improve this question
2  
Yep that would do it. –  Bainternet Aug 3 '11 at 16:16
add comment

closed as off topic by Chip Bennett, s_ha_dum, toscho Feb 6 '13 at 17:26

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

4 Answers

Best way: Remove the timthumb script from your server and change your theme so as to not require it in the first place.

Timthumb isn't really necessary with newer versions of WordPress. The add_image_size() function can be used to create custom image sizes in the theme. And most older themes I've seen still using it were using it to create a "thumbnail" type of functionality, which is now built into WordPress itself.

The only thing TimThumb really does that WordPress makes hard is the custom cropping, where you can crop images to one side or another instead of doing a middle based crop method. And most themes aren't using this functionality.

share|improve this answer
add comment

I agree with Otto that is would be much better to use the_post_thumbnail and add_image_size but one other thing that timthumb does is crop images on the fly so on an older site with thousands of images you would have to use Regenerate Thumbnails to re-crop which would be quite a task especially on shared hosting.

In addition to removing the allowed sites array make sure your server / hosting is configured not to need 777 permissions on the cache folder which I'm sure works with suPHP but does work with DSO chowed to nobody:nobody or www-data:www-data.

share|improve this answer
    
As a response to this, I finally got around to making this plugin that I've been wanting to make for about 6 months: wordpress.org/extend/plugins/dynamic-image-resizer . It might help some people. –  Otto Aug 4 '11 at 5:19
add comment

The original source for this (link withheld) provided no actual attack vector. Meaning the code you showed above was altered somehow to fetch a remote .php file using $allowedSites.

How that was accomplished is still a mystery since articles like these don't really go through the proper advisory's nor get any peer feedback, and they seem to have no idea how someone wrote a malicious url (like fetchbadphpfile.com) into timthumb.php ( or any other file for that matter).

Though this is bad coding on the part of timthumb for not validating urls ( or whatever) is still requires a hack either through another security problem or most likely a malicious pre-injected script.

ps. On a side note timthumb.php did actually have a documented XSS attack vector a few versions ago that went through several security advisories and got practically no attention...

share|improve this answer
3  
timthumb does validate but very badly, meaning that if you allow blogger.com then any link file from blogger.com.yourdomain.com can be uploaded to your cache directory. and that is how you can upload what ever you want to a badly coded timthumb version host. –  Bainternet Aug 3 '11 at 17:41
    
Ah I see, I never really looked at it, I read the original article about this and he provided no answer to how something like blogger.com.yourdomain.com ended up in the timthumb.php file. –  Wyck Aug 4 '11 at 21:25
add comment

WordThumb is a fork and rewrite of timthumb.php after the timthumb vulnerability. It is fully backwards compatible with timthumb and offers better security and equal or better performance.

http://code.google.com/p/wordthumb/

share|improve this answer
    
WordThumb now is integrated with Timthumb. Please download the latest version of Timthumb, that's all. –  Rilwis Aug 10 '11 at 0:54
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.