How to remediate – TimThumb Detection

1. Introduction

TimThumb Detection identifies instances of the TimThumb image resizing PHP script on web servers. This script is commonly used with WordPress websites but has a history of security vulnerabilities. Successful exploitation could allow attackers to gain unauthorized access and potentially compromise the entire website. Impact on confidentiality, integrity, and availability are all likely if exploited.

2. Technical Explanation

TimThumb contains flaws in its handling of image file paths and input validation. Attackers can exploit these weaknesses to execute arbitrary code on the server. The vulnerability requires a publicly accessible TimThumb installation within a WordPress environment.

• Root cause: Insufficient sanitisation of user-supplied data when processing image files, leading to potential remote code execution.
• Exploit mechanism: An attacker crafts a malicious URL containing a specially formatted image path that exploits the script’s vulnerabilities. This can allow them to upload and execute PHP code on the server.
• Scope: WordPress websites using vulnerable versions of TimThumb (versions prior to 3.4.3 are known to be affected).

3. Detection and Assessment

Confirming a TimThumb installation is the first step in assessing vulnerability. A quick check involves looking for specific files, while thorough assessment requires code analysis.

• Quick checks: Check for the presence of the /wp-content/themes/[theme name]/timthumb.php file or directory structure within your WordPress installation.
• Scanning: Nessus plugin ID 68794 can detect TimThumb installations, but results should be verified manually.
• Logs and evidence: Web server access logs may show requests to the /wp-content/themes/[theme name]/timthumb.php script.

ls -l /wp-content/themes/* | grep timthumb.php

4. Solution / Remediation Steps

The recommended solution is to remove or update TimThumb. Removing it is the safest option if it’s not actively used. If required, upgrade to a patched version.

4.1 Preparation

• Ensure you have access to file management tools or SSH access to the server. A roll back plan involves restoring from the backup created in step 1.
• Consider a change window for this task, especially on production systems. Approval may be needed from your IT manager.

4.2 Implementation

1. Step 1: Locate all instances of TimThumb within your WordPress installation (typically in the /wp-content/themes/[theme name]/ directory).
2. Step 2: Delete the TimThumb directory and its contents if the script is not actively used.
3. Step 3: If TimThumb is required, update it to version 3.4.3 or later. Download the latest version from a trusted source.

4.3 Config or Code Example

Before

<img src="?src=http://example.com/image.jpg&w=200&h=150" />

After

<img src="/wp-content/uploads/image.jpg" width="200" height="150" />

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of vulnerability. Input validation is key, as is keeping software up-to-date.

• Practice 1: Least privilege – limit the permissions granted to web server processes to reduce the impact if TimThumb is exploited.

4.5 Automation (Optional)

# Example Bash script to remove TimThumb directories
find /var/www/html/wp-content/themes -type d -name "timthumb" -exec rm -rf {} ;

5. Verification / Validation

Confirm the fix by checking for the absence of TimThumb files and verifying that image resizing still works if required.

• Post-fix check: Run ls -l /wp-content/themes/* | grep timthumb.php again; no output should be returned.
• Re-test: Re-run the earlier detection method (file existence check) to confirm TimThumb is no longer present.
• Monitoring: Check web server logs for any errors related to image resizing; a sudden increase in 404 errors could indicate an issue.

ls -l /wp-content/themes/* | grep timthumb.php

6. Preventive Measures and Monitoring

Regular security baselines and pipeline checks can prevent future occurrences of this vulnerability.

• Baselines: Update your WordPress security baseline to include a check for TimThumb installations and recommend its removal or upgrade.
• Pipelines: Add Static Application Security Testing (SAST) tools to your CI/CD pipeline to scan for vulnerable code, including known issues in TimThumb.
• Asset and patch process: Implement a regular patch review cycle for WordPress plugins and themes to ensure timely updates and address security vulnerabilities.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 2: Updating TimThumb might introduce new bugs or compatibility issues; review release notes carefully.

8. References and Resources

• Vendor advisory or bulletin: https://code.google.com/archive/p/timthumb
• NVD or CVE entry: No specific CVE exists for TimThumb itself, but related vulnerabilities in WordPress plugins using it may have entries.
• Product or platform documentation relevant to the fix: https://wordpress.org/documentation/plugins/managing-plugins