wpscan 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a35937f16511c0e2d5fe332f45489703704f91e2d38d48b46d4f42fb5fe153f
-  data.tar.gz: 2ced1bd5e24ce8d891d298d383c9a79b03d6d05fd614de60da7cf46808138a62
+  metadata.gz: b6e5b02dd5de5e0624c1dca1b8bb3bad6f16ff008fe054957e80c3ce33807a70
+  data.tar.gz: fb7cec3911f60cabbf70ac8e34672e4a41fe68a64bd76e9d7b55f0f5e901d012
 SHA512:
-  metadata.gz: 2ebbec3ada4d857b9be598636dbeaa65d524f3be1733204920f8fe23d03bf8ef6e3a9e446a3dbbfabda70d6da41562c7bb28115d5133497b002ad69ec6464731
-  data.tar.gz: d909b0d2ee28f28fb698c07301a4d42c6118cc6e4d7245b05e0ba329bc90a8a52f2af189c10dc437a7973db5ff4afd46604e5ce0e3889bdb6efdaaeccc879ed3
+  metadata.gz: 724a6be1ce5d754a9891781e7101bf5b504c056107d1a7dc4cb0bb107a03044ccfff73dd648f32e14bcc0d8299b8b7872e2cbdd8f813d928a2abd64402ed28f0
+  data.tar.gz: 9c31899c0110f312f496a934f585e661103a364cf535da47a49d9002594eb047b942715a299cf275fdc85c1143a725cb5ee9d3f3d86dcbe29a3e53f7a400c432

data/app/finders/wp_items/urls_in_page.rb

@@ -21,7 +21,7 @@ module WPScan
 
             slug = Regexp.last_match[1]&.strip
 
-            found << slug unless slug&.empty?
+            found << slug unless slug && slug.empty?
           end
 
           uniq ? found.uniq.sort : found.sort

data/app/models/timthumb.rb

@@ -42,7 +42,7 @@ module WPScan
           'Timthumb <= 1.32 Remote Code Execution',
           references: { exploitdb: ['17602'] },
           type: 'RCE',
-          fixed_in: '1.33'
+          affected_versions: [{ fixed_in: '1.33' }]
         )
       end
 
@@ -55,7 +55,7 @@ module WPScan
             cve: '2014-4663'
           },
           type: 'RCE',
-          fixed_in: '2.8.14'
+          affected_versions: [{ fixed_in: '2.8.14' }]
         )
       end
 

data/app/models/version.rb

@@ -34,7 +34,7 @@ module WPScan
 
       # @param [ Version, String ] other
       def <=>(other)
-        other = self.class.new(other) unless other.is_a?(self.class) # handle potential '.1' version
+        other = Version.new(other) unless other.is_a?(Version) # handle potential '.1' version
 
         Gem::Version.new(number) <=> Gem::Version.new(other.number)
       rescue ArgumentError

data/app/models/wp_item.rb

@@ -41,23 +41,25 @@ module WPScan
 
         Array(db_data['vulnerabilities']).each do |json_vuln|
           vulnerability = Vulnerability.load_from_json(json_vuln)
+          vulnerability.detected_version = version || nil
           @vulnerabilities << vulnerability if vulnerable_to?(vulnerability)
         end
 
         @vulnerabilities
       end
 
-      # Checks if the wp_item is vulnerable to a specific vulnerability
+      # Checks if the wp_item is vulnerable to a specific vulnerability.
+      # A vuln with multiple backported ranges matches when any single range
+      # covers the detected version.
       #
       # @param [ Vulnerability ] vuln Vulnerability to check the item against
       #
       # @return [ Boolean ]
       def vulnerable_to?(vuln)
-        return false if version && vuln&.introduced_in && version < vuln.introduced_in
+        return true unless version
+        return true if vuln.nil?
 
-        return true unless version && vuln&.fixed_in && !vuln.fixed_in.empty?
-
-        version < vuln.fixed_in
+        vuln.affects?(version)
       end
 
       # @return [ String ]

data/app/models/wp_version.rb

@@ -58,7 +58,9 @@ module WPScan
         @vulnerabilities = []
 
         Array(db_data['vulnerabilities']).each do |json_vuln|
-          @vulnerabilities << Vulnerability.load_from_json(json_vuln)
+          vulnerability = Vulnerability.load_from_json(json_vuln)
+          vulnerability.detected_version = self
+          @vulnerabilities << vulnerability
         end
 
         @vulnerabilities

data/lib/wpscan/db/vuln_api.rb

@@ -12,7 +12,7 @@ module WPScan
 
       # @return [ Addressable::URI ]
       def self.uri
-        @uri ||= Addressable::URI.parse('https://wpscan.com/api/v3/')
+        @uri ||= Addressable::URI.parse('https://wpscan.com/api/v4/')
       end
 
       # @param [ String ] path
@@ -21,7 +21,11 @@ module WPScan
       # @return [ Hash ]
       def self.get(path, params = {})
         return {} unless token
-        return {} if path.end_with?('/latest') # Remove this when api/v4 is up
+        # Guard against a slug or WordPress version equal to the literal
+        # string "latest": such a value would map to the
+        # /{plugins,themes,wordpresses,all}/latest list endpoints, which
+        # return a payload the per-entity parser below cannot handle.
+        return {} if path.end_with?('/latest')
 
         # Typhoeus.get is used rather than Browser.get to avoid merging irrelevant params from the CLI
         res = Typhoeus.get(uri.join(path), default_request_params.merge(params))

data/lib/wpscan/scan.rb

@@ -97,10 +97,9 @@ module WPScan
     # depending on the findings / errors
     # :nocov:
     def exit_hook
-      # Avoid hooking the exit when rspec is running, otherwise it will always return 0
-      # and Travis won't detect failed builds. Couldn't find a better way, even though
-      # some people managed to https://github.com/rspec/rspec-core/pull/410
-      return if defined?(RSpec)
+      # Avoid registering this hook when the RSpec suite is running, otherwise it
+      # can override RSpec's exit status and hide failed builds.
+      return if rspec_running?
 
       at_exit do
         exit(run_error_exit_code) if run_error
@@ -112,6 +111,10 @@ module WPScan
     end
     # :nocov:
 
+    def rspec_running?
+      defined?(RSpec)
+    end
+
     # @return [ Integer ] The exit code related to the run_error
     def run_error_exit_code
       return WPScan::ExitCode::CLI_OPTION_ERROR if run_error.is_a?(OptParseValidator::Error) ||

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '4.0.0'
+  VERSION = '4.0.1'
 end

data/lib/wpscan/vulnerability.rb

@@ -5,7 +5,12 @@ module WPScan
   class Vulnerability
     include References
 
-    attr_reader :title, :type, :fixed_in, :introduced_in, :cvss, :poc, :uuid
+    attr_reader :title, :type, :affected_versions, :cvss, :poc, :uuid
+
+    # Version of the scanned item (plugin/theme/WordPress), used to resolve
+    # which backported range to surface as the scalar fixed_in / introduced_in.
+    # Left nil/false when the version could not be detected.
+    attr_accessor :detected_version
 
     # @param [ String ] title
     # @param [ Hash ] references
@@ -17,21 +22,21 @@ module WPScan
     # @option references [ Array<String>, String ] :metasploit The related metasploit module(s)
     # @option references [ Array<String> ] :youtube
     # @param [ String ] type
-    # @param [ String ] fixed_in
-    # @param [ String ] introduced_in
+    # @param [ Array<Hash> ] affected_versions One entry per backported fix range,
+    #   each with :fixed_in and :introduced_in keys (either may be nil).
     # @param [ HashSymbol ] cvss
     # @option cvss [ String ] :score
     # @option cvss [ String ] :vector
     # rubocop:disable Metrics/ParameterLists
-    def initialize(title, references: {}, type: nil, fixed_in: nil, introduced_in: nil, cvss: nil, poc: nil, uuid: nil)
+    def initialize(title, references: {}, type: nil, affected_versions: nil, cvss: nil, poc: nil, uuid: nil)
       # rubocop:enable Metrics/ParameterLists
-      @title         = title
-      @type          = type
-      @fixed_in      = fixed_in
-      @introduced_in = introduced_in
-      @cvss          = { score: cvss[:score], vector: cvss[:vector] } if cvss
-      @poc           = poc
-      @uuid          = uuid
+      @title             = title
+      @type              = type
+      @affected_versions = normalize_affected_versions(affected_versions)
+      @cvss              = { score: cvss[:score], vector: cvss[:vector] } if cvss
+      @poc               = poc
+      @uuid              = uuid
+      @detected_version  = nil
 
       self.references = references
     end
@@ -51,14 +56,78 @@ module WPScan
         json_data['title'],
         references: references,
         type: json_data['vuln_type'],
-        fixed_in: json_data['fixed_in'],
-        introduced_in: json_data['introduced_in'],
+        affected_versions: json_data['affected_versions'],
         cvss: json_data['cvss']&.symbolize_keys,
         poc: json_data['poc'],
         uuid: json_data['id'].to_s # The 'id' field IS the UUID in WPScan API
       )
     end
 
+    # Whether this vulnerability covers a given version. True when no
+    # affected_versions are declared (advisory with no fix metadata) or when at
+    # least one backported range covers the version.
+    #
+    # @param [ #< ] version
+    #
+    # @return [ Boolean ]
+    def affects?(version)
+      return true if affected_versions.empty?
+
+      affected_versions.any? { |range| self.class.range_covers?(range, version) }
+    end
+
+    # Backward-compatible scalar: the fixed_in of the range relevant to the
+    # detected version (the branch the scanned site is actually on). nil when
+    # there is no fix metadata.
+    #
+    # @return [ String, nil ]
+    def fixed_in
+      relevant_range && relevant_range[:fixed_in]
+    end
+
+    # Backward-compatible scalar counterpart of {#fixed_in}.
+    #
+    # @return [ String, nil ]
+    def introduced_in
+      relevant_range && relevant_range[:introduced_in]
+    end
+
+    # The single affected-version range whose fixed_in / introduced_in we
+    # surface in the output. Picks the range covering the detected version so a
+    # site on an older but still-supported branch is matched against the right
+    # fix. Falls back to the highest (most recent) range when the version is
+    # unknown or no range covers it, mirroring the pre-v4 single-value output.
+    #
+    # @return [ Hash{Symbol => String, nil}, nil ]
+    def relevant_range
+      return nil if affected_versions.empty?
+
+      if detected_version
+        covering = affected_versions.find { |range| self.class.range_covers?(range, detected_version) }
+        return covering if covering
+      end
+
+      highest_range
+    end
+
+    # Whether a single range covers the version. A range matches when
+    # introduced_in is missing or <= version AND fixed_in is missing or >
+    # version.
+    #
+    # @param [ Hash{Symbol => String, nil} ] range
+    # @param [ #< ] version
+    #
+    # @return [ Boolean ]
+    def self.range_covers?(range, version)
+      introduced = range[:introduced_in]
+      fixed      = range[:fixed_in]
+
+      return false if introduced && !introduced.to_s.empty? && version < introduced
+      return true if fixed.nil? || fixed.to_s.empty?
+
+      version < fixed
+    end
+
     # @param [ Vulnerability ] other
     #
     # @return [ Boolean ]
@@ -66,10 +135,47 @@ module WPScan
       title == other.title &&
         type == other.type &&
         references == other.references &&
-        fixed_in == other.fixed_in &&
+        affected_versions == other.affected_versions &&
         cvss == other.cvss &&
         poc == other.poc &&
         uuid == other.uuid
     end
+
+    private
+
+    # The range with the greatest fixed_in. An unpatched range (no fixed_in)
+    # outranks every patched one. Used as the fallback for {#relevant_range}.
+    #
+    # @return [ Hash{Symbol => String, nil} ]
+    def highest_range
+      affected_versions.max_by { |range| version_key(range[:fixed_in]) }
+    end
+
+    # Comparable sort key for a fixed_in value. Returns a [tier, Gem::Version]
+    # tuple so a missing fixed_in (unpatched) always sorts highest, and patched
+    # ranges sort by their numeric version.
+    #
+    # @return [ Array ]
+    def version_key(fixed_in)
+      return [1, Gem::Version.new('0')] if fixed_in.nil? || fixed_in.to_s.empty?
+
+      [0, Gem::Version.new(fixed_in.to_s[/\A[\d.]+/] || '0')]
+    rescue ArgumentError
+      [0, Gem::Version.new('0')]
+    end
+
+    # Coerces the v4 affected_versions payload into an array of symbolised range
+    # hashes. Accepts either an array of hashes (with string or symbol keys) or
+    # nil; anything else is dropped so a malformed entry can't break parsing.
+    #
+    # @return [ Array<Hash{Symbol => String, nil}> ]
+    def normalize_affected_versions(value)
+      Array(value).filter_map do |range|
+        next unless range.is_a?(Hash)
+
+        range = range.transform_keys(&:to_sym)
+        { fixed_in: range[:fixed_in], introduced_in: range[:introduced_in] }
+      end
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.1
 platform: ruby
 authors:
 - WPScanTeam