Advisory

Overview

If logged in as an administrator of any WordPress blog on a WordPress multisite, you can extract all values in the database, including password hashes and user activation tokens.

This is achieved by a SQL injection, based on the fact that some of the configuration options are appended into a SQL query in a unsafe way.

The configuration page contains the following code, that allows the user to set the option relevanssi_post_type_weights to any value:

    function update_relevanssi_options() {
        ....
        foreach ($_REQUEST as $key => $value) {
            if (substr($key, 0, strlen('relevanssi_weight_')) == 'relevanssi_weight_') {
                $type = substr($key, strlen('relevanssi_weight_'));
                $post_type_weights[$type] = $value;
            }
            ....
        }
        if (count($post_type_weights) > 0) {
            update_option('relevanssi_post_type_weights', $post_type_weights);
        }
        ....
    }

Now when a search is made, the function relevanssi_search is called, this appends the user-controlled value into the SQL query:

    $post_type_weights = get_option('relevanssi_post_type_weights');

    ...

    !empty($post_type_weights['post_tag']) ? $tag = $post_type_weights['post_tag'] : $tag = $relevanssi_variables['post_type_weight_defaults']['post_tag'];

    !empty($post_type_weights['category']) ? $cat = $post_type_weights['category'] : $cat = $relevanssi_variables['post_type_weight_defaults']['category'];

    $query = "SELECT relevanssi.*, relevanssi.title * $title_boost +
          relevanssi.content + relevanssi.comment * $comment_boost +
          relevanssi.tag * $tag + relevanssi.link * $link_boost +
          relevanssi.author + relevanssi.category * $cat + relevanssi.excerpt +
          relevanssi.taxonomy + relevanssi.customfield + relevanssi.mysqlcolumn AS tf
          FROM $relevanssi_table AS relevanssi $query_join
          WHERE $term_cond $query_restrictions";

Proof of concept

1. Visit /wp-admin/options-general.php?page=relevanssi%2Frelevanssi.php
2. Assign 0.75' (the default value plus a single quote at the end) to “Tag weight”
3. Press “Save the options”
4. Visit /?s=test
5. The logs should contain the following error because of the syntax error we introduced: “WordPress database error You have an error in your SQL syntax”

Note: while it’s possible to inject syntax errors, it’s currently unknown whether this bug can be used to inject anything that would be useful to an attacker.

Mitigation/further actions

Upgrade to version 3.6.1 or later.

Advisory timeline

1. 2017-10-02: Discovered
2. 2017-10-02: Reported to vendor via email
3. 2017-10-03: First response from vendor
4. 2017-10-03: Version 3.6.1 released which contains a fix for this bug
5. 2018-04-10: Advisory published