A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin?

Can someone point me to an authoritative resource that addresses this vulnerability? It doesn't appear that the plugin is still being maintained / available in the repo?



Take a look here: http://ma.tt/2011/08/the-timthumb-saga/ I assume you know who Matt is. Also, Matt mentioned this guy in that link, and he's got some updates on the issue posted to his site http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/

The short is, there's now TimThumb 2.0 which is fixed. It's available here http://code.google.com/p/timthumb/

  • Yeah, I know the guy :) Thanks for pointing me to those posts and particularly Mark's update. Sounds like we're back on track.
    – Tom Auger
    Jun 4 '12 at 16:04
  • 1
    I should also mention that there's the wordpress.org/extend/plugins/timthumb-vulnerability-scanner Timthumb Vulnerability Scanner plugin that can help scan for bad code and keep things up-to-date. Highly recommended.
    – Tom Auger
    Jun 4 '12 at 16:05

I still consider timthumb.php to represent an inherent risk due to the way that it operates. As far as I know, the following statement remains true:

NOTE: timthumb.php is inherently insecure because it relies on being able to write files into a directory that is accessible by people visiting your website. That’s never a good idea.

Without looking through the source directly, I see nothing in this list of TimThumb 2.0 enhancements that changes the fundamental functionality of the script. The enhancements provide some additional security-through-obscurity, but in reality, obscurity is not security.

Until I see objective evidence to the contrary, I stand by my admonition to use the core image-resizing and post thumbnail functionality only and always.

  • But isn’t the same true for WordPress and the uploads directory? It can write files to a public visible directory.
    – fuxia
    Jun 4 '12 at 16:33
  • WordPress writing files to directories that it owns is a completely different matter from the world writing to directories that WordPress owns. Jun 4 '12 at 16:36
  • There's a list of some of the security measures here: markmaunder.com/2011/08/04/… No code is secure, it's all just a risk assessment.
    – user1337
    Jun 4 '12 at 16:44
  • Thanks Chip for your assessment. I totally agree and would never use this plugin for my own development. Unfortunately this is a client-purchased theme and there's no budget to retrofit Timthumb out of it.
    – Tom Auger
    Jun 5 '12 at 13:01
  • Chip, can you elaborate on your comment about the difference between WP using GDLib and writing out thumbnails to the uploads folder, and Timthumb doing the same? The difference is not obvious to me. They're both processes running under the same user (presumably Apache), and they both write to publicly-readable directories. Or is it the fact that Timthumb writes the unmodified, unfiltered content of the upload directly to the directory? Does WordPress not also write an original (unmodified) version of the image file before making the thumbnails?
    – Tom Auger
    Jun 5 '12 at 13:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.