PT-2013-1421 · Binarycanary · Timthumb

Hanno Böck · Published 2013-10-26 · Updated 2013-10-28 · CVE-2011-4106

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TimThumb (timthumb.php) versions prior to 2.0

Description The issue allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter. This is done by accessing the uploaded file via a direct request to the file in the cache directory. There have been real-world incidents where this issue was exploited, notably in August 2011.

Recommendations For versions prior to 2.0, update to version 2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the cache directory to minimize the risk of exploitation. Avoid using the src parameter with untrusted input until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-4106

Affected Products

Timthumb

References · 11

• 🔥 http://exploit-db.com/exploits/17872 · Exploit
• 🔥 http://code.google.com/p/timthumb/issues/detail?id=212 · Exploit
• 🔥 http://exploit-db.com/exploits/17602 · Exploit
• 🔥 https://exploit-db.com/exploits/17602 · Exploit
• 🔥 https://exploit-db.com/exploits/17872 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-4106 · Security Note
• http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack · Patch
• http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes · Note
• http://openwall.com/lists/oss-security/2011/11/03/4 · Note
• http://binarymoon.co.uk/2011/08/timthumb-2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4106 · Note