2

My company is comsidering to use WordPress as an internal blogging platform. It would be installed on a server that is accessible only through our intranet, no exposure to outside world. It would only be used as news page, with all the customizations done on our side (no third party plugins or layouts).

I would like to understand the risks involved in using WP this way. Do the vulnerabilities matter that much if the platform would only be available to internal employees and distributes the content that would be available to them anyway? Are regular updates enough to limit the risk?

1

I've done security research on WordPress in the past. The WordPress core itself is actually pretty secure. The main security problem exists in its third party plugins, because they get created by random (PHP) developers.

Another attack vector, like mentioned before, is the possibility to brute-force passwords by default. So all WordPress users should have strong passwords. Always instruct users not to re-use passwords across systems.

For in-depth security you should enforce network segmentation. If possible, make sure the server can't connect to servers/segments with higher security requirements. Note that it must be able to connect to the outside world, or else it can't retrieve updates.

To answer your questions directly:

Do the vulnerabilities matter that much if the platform would only be available to internal employees and distributes the content that would be available to them anyway?

The vulnerabilities matter in a sense that you don't want that WP box compromised, because it could be used to perform other attacks on the network. For example, an attacker could crack/intercept passwords of all WordPress users and log in to other resources, if passwords are re-used. However, like mentioned before, WordPress is actually pretty secure, and if you limit the third party plugins, have a strong (admin) password, and install regular updates, it should be fine. The attacker would need some kind of 0-day, but that goes for any service on your network; if your attacker has a 0-day there's not a lot you can do (besides proper network segmentation).

Are regular updates enough to limit the risk?

Yes. Regular updates, choosing strong passwords and limiting third party plugins should be enough to limit the risk.

Final note

As a final note, if you want to double-check your installation after launch, you can always run wpcan to check for common WordPress vulnerabilities (this thing does give regular false positives though):

https://wpscan.org/

-1

It depends.

If you fully trust all the employees, then the vulnerabilities may not matter much. However, if you run a large company with a large number of employees, at one point you'll have to admit that there's no way you can fully trust that many people. In which case, the intranet should be secured with similar vigilance as a more public facing services.

If WordPress is running on the same system as another critical application, then some WordPress vulnerabilities may be usable as an entry point to gain access to that critical system. Another consideration is if someone used the same credential in their WordPress account that they used in more critical systems, then an attacker can leverage their access to the WordPress system to steal those credentials.

Also, you need to consider that most security breaches are done by insiders, not external attackers. And they can often be more damaging than external breaches.

Finally, how confident are you that the intranet site isn't accessible from outside?

2

This question is two-fold really. First, what are the vulnerabilities of a wordpress site within your intranet, and the second are what are the risks of certain employees to that intranet. So i'll tackle this in two parts for clarity.

Intranet and Wordpress

A lot of companies set up internal sites for various reasons, but proper configuration should be done anyway, since WP itself has a lot of vulnerabilities. One of the more prominent security issues is the ease that its login credentials can be brute-forced.

Just because the site is on a company network, doesn't necessarily mean that it can't be reached / used by people on the network. If any machine that has access to the intranet becomes compromised, it can be used to access this WP site. A technique known as pivoting, allows an attacker to compromise one machine and then use that to leverage other machines on the same network quickly. So the WP site should still conform to security standards, eg. proper authentication, strong credentials, etc. Depending on what data is going to be stored behind this page, extra measures should be taken, will it be a blog? will it be a portal for employees to see their payslips? etc.

Employees

Within any company there will be various forms of risk. Whether this be internal, like disgruntled employees, or external actors, like competitors, criminals, etc. The goal is not to reduce them as much as possible.

Internal employees have a certain level of inherent trust, as in they may have key-cards to open doors, access to certain sensitive information, websites, etc. And this can and often does lead to acts of fraud or collusion occurring, where the employee might feel as though they deserve more, they should've got that raise, they work hard, etc. etc.

Internal actors still need to authenticate with the system to gain access to its internal assets, however it can be just as much a risk if someone wants to cause damage if they get admin credentials for that site, allowing it to be used as a platform for various other attacks.

External actors will have to get into the network first, which can be done in various ways, but a poorly configured WP site would be an excellent target to compromise, and possible use to pivot, maybe the admin credentials for the site are the same for someones laptop?

In any case, an internal site should be configured to at least a certain standard to avoid cases where it can be exploited. I hope this answers your question - if not I'll be happy to add more to it if you have further questions.

EDIT: I came across this article that highlights the points made in the "Intranet and Wordpress" section of the answer. Specifically about identifying sites on local networks and bruteforcing logins. it can be found here.

  • Does that mean it all comes down to proper configuration of the platform (turn off comments, use strong passwords for editors)? We got a huge pushback from our IT SEC department, but they provided rather generic explanation, that's why I've decided to look for information here. – rufus1530 Sep 27 '18 at 8:12
  • @rufus1530 With any new addition it creates more security risk, but if you absolutely have to have the site then the best thing to do would be to use strong passwords, make sure the site is up to date, and use suggested security plugins - I know you mentioned that it wouldn't use any third party plugins, just in an ideal scenario it would help – Connor J Sep 27 '18 at 8:16
  • +1 If an internal host/system becomes compromised, any accessible vulnerable target (in this case Wordpress) will likely be used by the attacker to pivot and/or compromise additional hosts. Thus the importance of deploying secure services. – user2320464 Sep 27 '18 at 17:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.