CVE-2012-4448 pci-scan

Question

I'm currently failing a PCI scan due to CVE-2012-4448 The recommended resolution from Security Metrics is to upgrade to a wordpress version higher than 3.4.2, however currently that is the highest version. researching the CVE reveals there is no currently no vendor solution. It seems to me that this means currently a server running Wordpress can not be PCI compliant. Is my understanding of the situation correct?

Answer 1

I'm a developer for an open source project called WPScan, a WordPress vulnerability scanner.

Having spoken to one of the lead WordPress developers a couple of weeks ago regarding this issue, WordPress saw this particular vulnerability as low risk. However, it will be patched in the new release which should be any day now.

I've just implemented a quick 'fix' on my personal blog to prevent the exploitation of this vulnerability.

In wp-admin/includes/dashboard.php comment out lines 1065-1093. This comments out the content of the wp_dashboard_rss_control function which receives the user controllable $_POST['widget-rss'][$number] variable which is needed to exploit this vulnerability.

This did prevent the exploitation of the vulnerability. I did not notice any other adverse affects in doing this on my blog, however, doing so may affect some other parts of the system, but I did not see this.

The above is an option if you can't wait a few days to a week for WordPress to release the patched version.

If you want a more secure blog as well as passing PCI, check out WPScan.

Answer 2

At the moment you are correct, without custom code you can't protect your wordpress site for certain actions because of CVE-2012-4448.

There is an example exploit that can be found here. I was reviewing if a plugin like Bullet Proof Security might help. But while they advertise that they indeed protect against CSRF the only thing I can find at the moment is some basic filtering with .htaccess for certain folders (and nothing else really) (I've challenged them and I'm awaiting a reply on how they actually implement CSRF protection).

I also was looking at the changelog of wordpress 3.5 but I can't confirm they have already fixed this in the beta.

So at the moment, I'd have to conclude you are correct.

UPDATE:

Got this back from AITpro:

Yes the wpnonce is CSRF protection.  At some point we will also additionally utilize OWASP's CSRFGuard, but at this point CSRF protection is already so good in WordPress it is not really necessary.