WooThemes服务器遭遇入侵，其Framework存在漏洞

2012 年 5 月 2 日

最后更新于 2015 年 8 月 14 日

WooThemes是一家知名的WordPress主题提供商，4月30日其服务器遭遇DDOS攻击，每秒有8GB的数据包发送到服务器，导致WooThemes网站一度无法访问。

woothemes hacked

WooThemes Shortcode Exploit

在网站遭遇攻击之前，有人爆出WooThemes Framework存在漏洞—Sshortcode Exploit，以下评论来自WooThemes开发者

The shortcode preview functionality that was in the WooFramework’s bundled shortcode generator (the neat popup used to add shortcodes to posts and pages with a point-and-click interface) was identified as a potential security exploit several days ago. After the first report was made, we began work on isolating and resolving this exploit. This resulted in the removal of this functionality from the WooFramework (the shortcode generator is still there… just the preview functionality was removed).
The potential exploit is such that the shortcode preview allowed users to generate shortcodes using the preview window’s file, without authenticating the user.

WooThemes为TinyMCE编辑器提供了Shortcode按钮，每个Shortcode都带有预览（preview）功能，漏洞在于预览地址使用iframe展示，iframe的地址可以直接访问，即使用户未登陆。