CVE-2018-6389 PoC — WordPress 安全漏洞

Source

https://github.com/vineetkia/Wordpress-DOS-Attack-CVE-2018-6389

Associated Vulnerability

Title: WordPress 安全漏洞 (CVE-2018-6389)
Description:In WordPress through 4.9.2, unauthenticated attackers can cause a denial of service (resource consumption) by using the large list of registered .js files (from wp-includes/script-loader.php) to construct a series of requests to load every file many times.

Description

load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request.

Readme

# Wordpress-DOS-Attack-CVE-2018-6389

[![Build Status](https://travis-ci.org/joemccann/dillinger.svg?branch=master)](https://www.cvedetails.com/cve/CVE-2018-6389)

Load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request.
```sh
$ chmod +x Execute.sh
$ ./Execute.sh
```

# How it Works!
- The problem lies upon the load-scripts.php file, which purpose is to retrieve several Javascript packages through one single request, such as bootstrap, jquery, and jqueryUI, among others.

- It is possible to create a special request to retrieve a huge quantity of different Javascripts, resulting in a high CPU resource and high bandwidth usage.

- Using a simple tool, it is possible to send hundreds of requests per second, which can easily increase RAM and CPU usage to the limit, resulting in a web server failure that would prevent users from accessing the attacked website or any other websites hosted on the same server.

<p align="center">
  <img src="IMG.png" width="350" alt="accessibility text">
</p>


-------------------------------------------------------------------------------------------------------------------------------------------

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →