wpscan 3.8.15 → 3.8.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 021d424ab717a7f32d4ed40025ed98d1572c4ef94193c48b31228c793ef616cc
-  data.tar.gz: 0f5d3192ab56199f4ee403d6a94db378fdeba7a080fbef3a6c5aa12175d8b855
+  metadata.gz: a2b3e70edcacc1f1b15ffab1fa686732b1cfc9b6aa4346bd88e0e517082c7aec
+  data.tar.gz: fb794ab8574c5e1fa66553a7e954eaa5467ed62943ae68407124e6396e9359a4
 SHA512:
-  metadata.gz: 78c4a98e1efe92ab08fa8c2f90e0a8851b8a076cdd4ce8faf755af6316d38bf496d862aedbe3532e523333d858df8668e3258112db2416548fd96073536d14bd
-  data.tar.gz: 1f7d881cfc1aad30dfc810815d5dfa1991d85bc37970cad76757d9bde4a2d25f66c842fb87cd5b5298ddd943c702a995a63dd075fa6d427ca0691151b0d471fe
+  metadata.gz: 0b02409d2b49a831960a39aaca578aadb07bf1390f6ced4a91edc8e2be42f05287883213cedf2df279f5b763213d595c26defe1abc0f4f075cfc3e9a7a028e03
+  data.tar.gz: 7857de71dd8d276a150afb3f69a4e184cf9e7cd3d9b4ba61a058af1dad92e98594c154246fe7ded7a21ca84bc4ecba885a1ae3d4fb883b9449fb016ab10195fe

data/README.md

@@ -15,6 +15,7 @@
 
 <p align="center">
   <a href="https://badge.fury.io/rb/wpscan" target="_blank"><img src="https://badge.fury.io/rb/wpscan.svg"></a>
+  <a href="https://hub.docker.com/r/wpscanteam/wpscan/" target="_blank"><img src="https://img.shields.io/docker/pulls/wpscanteam/wpscan.svg"></a>
   <a href="https://github.com/wpscanteam/wpscan/actions?query=workflow%3ABuild" target="_blank"><img src="https://github.com/wpscanteam/wpscan/workflows/Build/badge.svg"></a>
   <a href="https://codeclimate.com/github/wpscanteam/wpscan" target="_blank"><img src="https://codeclimate.com/github/wpscanteam/wpscan/badges/gpa.svg"></a>
 </p>
@@ -52,7 +53,7 @@ On MacOSX, if a ```Gem::FilePermissionError``` is raised due to the Apple's Syst
 
 You can update the local database by using ```wpscan --update```
 
-Updating WPScan itself is either done via ```gem update wpscan``` or the packages manager (this is quite important for distributions such as in Kali Linux: ```apt-get update && apt-get upgrade```) depending how WPScan was (pre)installed
+Updating WPScan itself is either done via ```gem update wpscan``` or the packages manager (this is quite important for distributions such as in Kali Linux: ```apt-get update && apt-get upgrade```) depending on how WPScan was (pre)installed
 
 # Docker
 

data/app/controllers/enumeration/cli_options.rb

@@ -170,6 +170,12 @@ module WPScan
             ['--users-detection MODE',
              'Use the supplied mode to enumerate Users, instead of the global (--detection-mode) mode.'],
             choices: %w[mixed passive aggressive], normalize: :to_sym, advanced: true
+          ),
+          OptRegexp.new(
+            [
+              '--exclude-usernames REGEXP_OR_STRING',
+              'Exclude usernames matching the Regexp/string (case insensitive). Regexp delimiters are not required.'
+            ], options: Regexp::IGNORECASE
           )
         ]
       end

data/app/finders/db_exports/known_locations.rb

@@ -39,18 +39,57 @@ module WPScan
         #
         # @return [ Hash ]
         def potential_urls(opts = {})
-          urls        = {}
-          domain_name = (PublicSuffix.domain(target.uri.host) || target.uri.host)[/(^[\w|-]+)/, 1]
+          urls = {}
+          index = 0
 
-          File.open(opts[:list]).each_with_index do |path, index|
-            path.gsub!('{domain_name}', domain_name)
+          File.open(opts[:list]).each do |path|
+            path.chomp!
 
-            urls[target.url(path.chomp)] = index
+            if path.include?('{domain_name}')
+              urls[target.url(path.gsub('{domain_name}', domain_name))] = index
+
+              if domain_name != domain_name_with_sub
+                urls[target.url(path.gsub('{domain_name}', domain_name_with_sub))] = index + 1
+
+                index += 1
+              end
+            else
+              urls[target.url(path)] = index
+            end
+
+            index += 1
           end
 
           urls
         end
 
+        def domain_name
+          @domain_name ||= if Resolv::AddressRegex.match?(target.uri.host)
+                             target.uri.host
+                           else
+                             (PublicSuffix.domain(target.uri.host) || target.uri.host)[/(^[\w|-]+)/, 1]
+                           end
+        end
+
+        def domain_name_with_sub
+          @domain_name_with_sub ||=
+            if Resolv::AddressRegex.match?(target.uri.host)
+              target.uri.host
+            else
+              parsed = PublicSuffix.parse(target.uri.host)
+
+              if parsed.subdomain
+                parsed.subdomain.gsub(".#{parsed.tld}", '')
+              elsif parsed.domain
+                parsed.domain.gsub(".#{parsed.tld}", '')
+              else
+                target.uri.host
+              end
+            end
+        rescue PublicSuffix::DomainNotAllowed
+          @domain_name_with_sub = target.uri.host
+        end
+
         def create_progress_bar(opts = {})
           super(opts.merge(title: ' Checking DB Exports -'))
         end

data/app/finders/interesting_findings/multisite.rb

@@ -13,7 +13,7 @@ module WPScan
 
           return unless [200, 302].include?(res.code)
           return if res.code == 302 && location&.include?('wp-login.php?action=register')
-          return unless res.code == 200 || res.code == 302 && location&.include?('wp-signup.php')
+          return unless res.code == 200 || (res.code == 302 && location&.include?('wp-signup.php'))
 
           target.multisite = true
 

data/app/finders/users.rb

@@ -11,6 +11,16 @@ require_relative 'users/yoast_seo_author_sitemap'
 
 module WPScan
   module Finders
+    # Specific Finders container to filter the usernames found
+    # and remove the ones matching ParsedCli.exclude_username if supplied
+    class UsersFinders < SameTypeFinders
+      def filter_findings
+        findings.delete_if { |user| ParsedCli.exclude_usernames.match?(user.username) } if ParsedCli.exclude_usernames
+
+        findings
+      end
+    end
+
     module Users
       # Users Finder
       class Base
@@ -28,6 +38,10 @@ module WPScan
             Users::AuthorIdBruteForcing.new(target) <<
             Users::LoginErrorMessages.new(target)
         end
+
+        def finders
+          @finders ||= Finders::UsersFinders.new
+        end
       end
     end
   end

data/app/finders/wp_version.rb

@@ -10,7 +10,7 @@ module WPScan
   module Finders
     # Specific Finders container to filter the version detected
     # and remove the one with low confidence to avoid false
-    # positive when there is not enought information to accurately
+    # positive when there is not enough information to accurately
     # determine it.
     class WpVersionFinders < UniqueFinders
       def filter_findings

data/app/models/timthumb.rb

@@ -30,7 +30,7 @@ module WPScan
       def vulnerabilities
         vulns = []
 
-        vulns << rce_webshot_vuln if version == false || version > '1.35' && version < '2.8.14' && webshot_enabled?
+        vulns << rce_webshot_vuln if version == false || (version > '1.35' && version < '2.8.14' && webshot_enabled?)
         vulns << rce_132_vuln if version == false || version < '1.33'
 
         vulns

data/app/models/wp_item.rb

@@ -53,7 +53,9 @@ module WPScan
       #
       # @return [ Boolean ]
       def vulnerable_to?(vuln)
-        return true unless version && vuln && vuln.fixed_in && !vuln.fixed_in.empty?
+        return false if version && vuln&.introduced_in && version < vuln.introduced_in
+
+        return true unless version && vuln&.fixed_in && !vuln.fixed_in.empty?
 
         version < vuln.fixed_in
       end
@@ -160,7 +162,7 @@ module WPScan
       #
       # @return [ Typhoeus::Response ]
       def head_and_get(path, codes = [200], params = {})
-        final_path = +@path_from_blog
+        final_path = @path_from_blog.dup # @path_from_blog is set in the plugin/theme
         final_path << path unless path.nil?
 
         blog.head_and_get(final_path, codes, params)

data/app/views/cli/wp_version/version.erb

@@ -1,5 +1,5 @@
 <% if @version -%>
-<%= info_icon %> WordPress version <%= @version.number %> identified (<%= @version.status.capitalize %>, released on <%= @version.release_date %>).
+<%= info_icon %> WordPress version <%= @version.number %> identified (<%= @version.status.tr('-', '_').humanize %>, released on <%= @version.release_date %>).
 <%= render('@finding', item: @version) -%>
 <% else -%>
 <%= notice_icon %> The WordPress version could not be detected.

data/lib/wpscan/db/dynamic_finders/base.rb

@@ -11,7 +11,11 @@ module WPScan
 
         # @return [ Hash ]
         def self.all_df_data
-          @all_df_data ||= YAML.safe_load(File.read(df_file), [Regexp])
+          @all_df_data ||= if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('4.0.0')
+                             YAML.safe_load(File.read(df_file), permitted_classes: [Regexp])
+                           else
+                             YAML.safe_load(File.read(df_file), [Regexp])
+                           end
         end
 
         # @return [ Array<Symbol> ]

data/lib/wpscan/db/updater.rb

@@ -24,7 +24,9 @@ module WPScan
 
         FileUtils.mkdir_p(repo_directory.to_s) unless Dir.exist?(repo_directory.to_s)
 
-        raise "#{repo_directory} is not writable" unless repo_directory.writable?
+        unless repo_directory.writable?
+          raise "#{repo_directory} is not writable (uid: #{Process.uid}, gid: #{Process.gid})"
+        end
 
         delete_old_files
       end

data/lib/wpscan/errors/enumeration.rb

@@ -5,16 +5,16 @@ module WPScan
     class PluginsThresholdReached < Standard
       def to_s
         "The number of plugins detected reached the threshold of #{ParsedCli.plugins_threshold} " \
-        'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
-        'option to ignore the bad responses.'
+          'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
+          'option to ignore the bad responses.'
       end
     end
 
     class ThemesThresholdReached < Standard
       def to_s
         "The number of themes detected reached the threshold of #{ParsedCli.themes_threshold} " \
-        'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
-        'option to ignore the bad responses.'
+          'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
+          'option to ignore the bad responses.'
       end
     end
   end

data/lib/wpscan/errors/wordpress.rb

@@ -26,7 +26,7 @@ module WPScan
     class WpContentDirNotDetected < Standard
       def to_s
         'Unable to identify the wp-content dir, please supply it with --wp-content-dir,' \
-        ' use the --scope option or make sure the --url value given is the correct one'
+          ' use the --scope option or make sure the --url value given is the correct one'
       end
     end
 

data/lib/wpscan/finders/dynamic_finder/finder.rb

@@ -56,7 +56,9 @@ module WPScan
 
           homepage_result = find(target.homepage_res, opts)
 
-          return homepage_result unless homepage_result.nil? || homepage_result.is_a?(Array) && homepage_result&.empty?
+          unless homepage_result.nil? || (homepage_result.is_a?(Array) && homepage_result&.empty?)
+            return homepage_result
+          end
 
           find(target.error_404_res, opts)
         end

data/lib/wpscan/target/platform/wordpress/custom_directories.rb

@@ -125,14 +125,14 @@ module WPScan
           return @uri.to_s unless path
 
           if %r{wp-content/plugins}i.match?(path)
-            path = +path.gsub('wp-content/plugins', plugins_dir)
+            new_path = path.gsub('wp-content/plugins', plugins_dir)
           elsif /wp-content/i.match?(path)
-            path = +path.gsub('wp-content', content_dir)
+            new_path = path.gsub('wp-content', content_dir)
           elsif path[0] != '/' && sub_dir
-            path = "#{sub_dir}/#{path}"
+            new_path = "#{sub_dir}/#{path}"
           end
 
-          super(path)
+          super(new_path || path)
         end
       end
     end

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '3.8.15'
+  VERSION = '3.8.19'
 end

data/lib/wpscan/vulnerability.rb

@@ -21,6 +21,7 @@ module WPScan
         references: references,
         type: json_data['vuln_type'],
         fixed_in: json_data['fixed_in'],
+        introduced_in: json_data['introduced_in'],
         cvss: json_data['cvss']&.symbolize_keys
       )
     end

data/lib/wpscan.rb

@@ -13,6 +13,7 @@ require 'uri'
 require 'time'
 require 'readline'
 require 'securerandom'
+require 'resolv'
 # Monkey Patches/Fixes/Override
 require 'wpscan/typhoeus/response' # Adds a from_vuln_api? method
 # Custom Libs

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 3.8.15
+  version: 3.8.19
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-15 00:00:00.000000000 Z
+date: 2021-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cms_scanner
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.1
+        version: 0.13.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.1
+        version: 0.13.6
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.21.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.0
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +170,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.0
+        version: 3.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.11.0
+        version: 3.13.0
 description: WPScan is a black box WordPress vulnerability scanner.
 email:
 - contact@wpscan.com
@@ -397,7 +397,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.0.3.1
 signing_key: 
 specification_version: 4
 summary: WPScan - WordPress Vulnerability Scanner