wpscan 3.8.18 → 3.8.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7fc9dea6d2aa00fc366bbe8f1cde8af5668597020b0f3762aba9c8bd0f4f720
-  data.tar.gz: 5bd79cbef80eb57065cafab7bbf787f4d71de73052068ac37d6a407ca86b813c
+  metadata.gz: 22b6d832d1770e8cac645d0b6522acf74fb1ae7282ccd576c35dc0c2f34c91a7
+  data.tar.gz: 53154ef76c9489dee96220ef01069802158b4087183ff8b8136d580f7dd5437e
 SHA512:
-  metadata.gz: d093d424143d40bc594dc8f5ef5e6b577bdb09e8e1aff5289da2f471a1b5b7bccdde600c91700300a940281763b6b74e0b6384a23220d928b9e1edef947dac21
-  data.tar.gz: 4032d8268e1961adc1c767bf6857ba5ff46c929c3534955f56550af65aa6996c59e3a2ec17f2c95f8c1af6efbc992122c5cc4f6ee3c012b978e4a5a5c9446e28
+  metadata.gz: c0da7e059312f7480b35df4311d2297facb1c557244d4a8bdb5270e01c35e6807c4b3c5192b174089ba770921e2231fac440da6783568e0708f8ab58a720ceb7
+  data.tar.gz: b7b8aa218b77d7f0857bf085d91a944578fbdc88d5fa7e58a59bb674b6a65f847d6e6b73b4cb4afbbc9cdc0ab90805db89bde234abf8208b92f0e97ef8aa72b8

data/app/finders/interesting_findings/multisite.rb

@@ -13,7 +13,7 @@ module WPScan
 
           return unless [200, 302].include?(res.code)
           return if res.code == 302 && location&.include?('wp-login.php?action=register')
-          return unless res.code == 200 || res.code == 302 && location&.include?('wp-signup.php')
+          return unless res.code == 200 || (res.code == 302 && location&.include?('wp-signup.php'))
 
           target.multisite = true
 

data/app/finders/plugin_version/readme.rb

@@ -59,13 +59,13 @@ module WPScan
         #
         # @return [ String, nil ] The best version number detected from the changelog section
         def from_changelog_section(body)
-          extracted_versions = body.scan(%r{=+\s+(?:v(?:ersion)?\s*)?([0-9.-]+)[ \ta-z0-9().\-/]*=+}i)
+          extracted_versions = body.scan(/^=+\s+(?:v(?:ersion)?\s*)?([0-9.-]+)[^=]*=+$/i)
 
           return if extracted_versions.nil? || extracted_versions.empty?
 
           extracted_versions.flatten!
           # must contain at least one number
-          extracted_versions = extracted_versions.select { |x| x =~ /[0-9]+/ }
+          extracted_versions = extracted_versions.grep(/[0-9]+/)
 
           sorted = extracted_versions.sort do |x, y|
             Gem::Version.new(x) <=> Gem::Version.new(y)

data/app/models/timthumb.rb

@@ -30,7 +30,7 @@ module WPScan
       def vulnerabilities
         vulns = []
 
-        vulns << rce_webshot_vuln if version == false || version > '1.35' && version < '2.8.14' && webshot_enabled?
+        vulns << rce_webshot_vuln if version == false || (version > '1.35' && version < '2.8.14' && webshot_enabled?)
         vulns << rce_132_vuln if version == false || version < '1.33'
 
         vulns

data/lib/wpscan/db/updater.rb

@@ -24,7 +24,13 @@ module WPScan
 
         FileUtils.mkdir_p(repo_directory.to_s) unless Dir.exist?(repo_directory.to_s)
 
-        raise "#{repo_directory} is not writable" unless repo_directory.writable?
+        # When --no-update is passed, return to avoid raising an error if the directory is not writable
+        # Mainly there for Homebrew: https://github.com/wpscanteam/wpscan/pull/1455
+        return if ParsedCli.update == false
+
+        unless repo_directory.writable?
+          raise "#{repo_directory} is not writable (uid: #{Process.uid}, gid: #{Process.gid})"
+        end
 
         delete_old_files
       end
@@ -129,7 +135,7 @@ module WPScan
         res = Typhoeus.get(file_url, request_params)
         raise Error::Download, res if res.timed_out? || res.code != 200
 
-        File.open(file_path, 'wb') { |f| f.write(res.body) }
+        File.binwrite(file_path, res.body)
 
         local_file_checksum(filename)
       end

data/lib/wpscan/errors/enumeration.rb

@@ -5,16 +5,16 @@ module WPScan
     class PluginsThresholdReached < Standard
       def to_s
         "The number of plugins detected reached the threshold of #{ParsedCli.plugins_threshold} " \
-        'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
-        'option to ignore the bad responses.'
+          'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
+          'option to ignore the bad responses.'
       end
     end
 
     class ThemesThresholdReached < Standard
       def to_s
         "The number of themes detected reached the threshold of #{ParsedCli.themes_threshold} " \
-        'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
-        'option to ignore the bad responses.'
+          'which might indicate False Positive. It would be recommended to use the --exclude-content-based ' \
+          'option to ignore the bad responses.'
       end
     end
   end

data/lib/wpscan/errors/wordpress.rb

@@ -26,7 +26,7 @@ module WPScan
     class WpContentDirNotDetected < Standard
       def to_s
         'Unable to identify the wp-content dir, please supply it with --wp-content-dir,' \
-        ' use the --scope option or make sure the --url value given is the correct one'
+          ' use the --scope option or make sure the --url value given is the correct one'
       end
     end
 

data/lib/wpscan/finders/dynamic_finder/finder.rb

@@ -56,7 +56,9 @@ module WPScan
 
           homepage_result = find(target.homepage_res, opts)
 
-          return homepage_result unless homepage_result.nil? || homepage_result.is_a?(Array) && homepage_result&.empty?
+          unless homepage_result.nil? || (homepage_result.is_a?(Array) && homepage_result&.empty?)
+            return homepage_result
+          end
 
           find(target.error_404_res, opts)
         end

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '3.8.18'
+  VERSION = '3.8.21'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 3.8.18
+  version: 3.8.21
 platform: ruby
 authors:
 - WPScanTeam
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-06-08 00:00:00.000000000 Z
+date: 2022-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cms_scanner
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.5
+        version: 0.13.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.13.5
+        version: 0.13.7
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.0
+        version: 3.11.0
 - !ruby/object:Gem::Dependency
   name: rspec-its
   requirement: !ruby/object:Gem::Requirement
@@ -100,28 +100,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.25.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.0
+        version: 1.25.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.11.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -170,14 +170,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 3.14.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.13.0
+        version: 3.14.0
 description: WPScan is a black box WordPress vulnerability scanner.
 email:
 - contact@wpscan.com