<http://schema.org/articleBody>
"If your website runs on a self-hosted WordPress installation or on Drupal, update your software now.\nNir Goldshlager, a security researcher from Salesforce.com's product security team, has discovered an XML vulnerability that impacts the popular website platforms WordPress and Drupal.\nThe vulnerability uses a well-known XML Quadratic Blowup Attack \u2014 and when executed, it can take down an entire website or server almost instantly.\nThis is a big deal because WordPress and Drupal are used by millions of websites. The latest statistics from W3Techs shows WordPress alone powers nearly 23% of the web.\nThe XML vulnerability Goldshlager discovered affects WordPress versions 3.5 to 3.9 (the current version) and works on the default installation. It affects Drupal versions 6.x to 7.x (the latest version) and also works on the default installation.\nThe good news is that both WordPress and Drupal have released patches for their applications. Users and web hosts simply need to upgrade to the latest version to protect against the vulnerability.\nWhen the vulnerability is exploited, the results can basically render a website or web server unusable. The vulnerability can cause 100% CPU and RAM usage, cause the server to become unavailable and also create a Denial of Service attack on the MySQL database program.\nIn other words, your website and web server can become totally inaccessible.\nHow the attack works\nThis vulnerability uses what is called an XML Quadratic Blowup Attack. This type of attack is similar to a Billion Laughs attack, which can allow a very small XML document to totally disrupt the services on machine in a matter of seconds.\nThe Quadratic Blowup Attack is similar; however, instead of using nested entities inside an XML document, it just repeats one large entity with tens of thousands of characters over and over again.\nWith this type of attack, an XML document that might be a few hundred kilobytes in size can end up requiring hundreds of megabytes or even gigabytes of memory. That will easily bring down an entire website or web server.\nIn Goldshlager's words:\n\"If an attacker defines the entity \"&amp;x;\" as 55,000 characters long, and refers to that entity 55,000 times inside the \"DoS\" element, the parser ends up with an XML Quadratic Blowup attack payload slightly over 200 KB in size that expands to 2.5 GB when parsed. This expansion is enough to take down the parsing process.\"\nHow the attack is exploited\nThe default memory allocation limit for PHP (the language that WordPress and Drupal are written in) is 128MB per process. In theory, this means that you can't exceed the 128MB limit with an XML bomb request. So far so good, right?\nHere's the problem: Apache, the world's most popular web server, has its \"Max Clients\" property set to 256 by default. Meanwhile, MySQL, the database that WordPress and Drupal use, has its default \"Max Connections\" value set to 151.\nIf we multiply those connections against one another (128x151), we get 19328MB \u2014 which will consume all available memory.\nTo successfully attack the server, the attacker needs to fingerprint the available memory limit on the victim's server. If the attack overwrites the PHP limit, the server will reject the overwrite, rendering the attack unsuccessful.\nA successful attack, however, will return the injected payload as a result. This will bring down the system.\n\nWordPress Denial Of Service PoC Video from Nir on Vimeo.\nThe fix\nWordPress and Drupal have both updated their software to protect against this vulnerability. The update procedure will vary based on your setup.\nWordPress 3.7 introduced automatic updates for minor releases for this very reason. This allows security patches, such as this one, to get rolled out to users automatically.\nAutomatic updates can turned on or off at the discretion of your web host, so it's a good idea to check your settings and update manually if automatic updates are not enabled.\nComment on disclosure\nBecause of the potential vector size of this vulnerability, Goldshlager made sure to responsibly disclose the vulnerability to the WordPress and Drupal teams before sharing the results with the public.\nThis allowed the teams time to patch their respective pieces of software before the vulnerability was exploited on a large scale.\nGiven the nature of this type of attack \u2014 and the relative ease in which it could have been exploited \u2014 the repercussions for plenty of website owners and web hosts could have been innumerable. WordPress alone is used by many of the biggest publishers on the web \u2014 not to mentions millions upon millions of regular users and small businesses. \nResponsible disclosure was the best way to get the issue out in the open, and also fixed.\nNotably, the WordPress and Drupal teams worked together on this solution and timed their security releases to coincide with one another.\nBecause the vulnerability targets WordPress's XML-RPC library file \u2014 a file that Drupal uses a derivative of \u2014 it made sense for the teams to work together on a patch and release.\nMashable worked with Goldshlager in preparing this post and writing up the disclosure, in the hopes that we can get the word out to as many people as possible. If you're running WordPress or Drupal, update now."^^<http://www.w3.org/2001/XMLSchema#string>
<http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/>