wpscan 4.1.0 → 4.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6215ce3d361d0754721dab264b279b43c0064cb2621a14720db0e15167bbc52
-  data.tar.gz: 6c092df8d32bb9f5e0a750c2801fb7cd086c6f258f404023581dc61c194fb962
+  metadata.gz: b66209f9f28c78f30d0d121c6841ffe370dc0109e3dde221a1212187522a0ff1
+  data.tar.gz: 12c257dbfc4ec49bfb438cc1abceeebebfc313690251d0e9e059978b76ac940e
 SHA512:
-  metadata.gz: b74ca0ee959b570d23d23d51936f121e31a16ef73ec896c5b1f6e97f503d6000c129cb3655fac0b6bca8072f7047c2bfad46711b77fb16f4f4cbdd9069a10311
-  data.tar.gz: 3067ba3dc843c74014b1bbda40ca2be6549fc17924aa64456128a667f91d20957ef86c1d79b430767fc2cb9a4a4b1b9fbb3bfd1d3f92c5edf94bb6c993ae8b23
+  metadata.gz: 8623ccd870f308d9bf7f8ce19dc77c7281b50155ade1e73c14f82644c0e30085dc7aaf4f7ff61513f9b7d757bfb1c3b77dbde0999a1fc59a8d44f9cd2c2b1fb4
+  data.tar.gz: 8bc2e65b6320bc40f069495a8359c91bc3edb7ae91242e54df552eb77a5e73c76a4a3ddfdd677a07bed6cdee5df34a5f910835eeb1e13b3f27bee03fdd63eba6

data/app/controllers/core/cli_options.rb

@@ -87,7 +87,12 @@ module WPScan
                                  default: 30),
           OptBoolean.new(['--disable-tls-checks',
                           'Disables SSL/TLS certificate verification, and downgrade to TLS1.0+ ' \
-                          '(requires cURL 7.66 for the latter)'])
+                          '(requires cURL 7.66 for the latter)']),
+          OptPositiveInteger.new(['--max-response-size MiB',
+                                  'Stop reading any response once it exceeds this size, in MiB. ' \
+                                  'Guards against memory exhaustion on targets serving very large ' \
+                                  'or endless responses. At most 2047, as a 2 GiB body cannot be parsed.'],
+                                 default: 16, max: 2047, advanced: true)
         ] + cli_browser_proxy_options + cli_browser_cookies_options + cli_browser_cache_options
       end
 

data/app/finders/users/wp_json_api.rb

@@ -46,6 +46,9 @@ module WPScan
 
           if json.is_a?(Enumerable)
             json.each do |user|
+              # Some security plugins strip the slug from the API output
+              next if user['slug'].blank?
+
               found << Model::User.new(user['slug'],
                                        id: user['id'],
                                        found_by: found_by,

data/app/formatters/sarif.rb

@@ -96,12 +96,17 @@ module WPScan
       def components(data)
         list = []
         list << core_component(data) if data['version']
-        list << theme_component(data['main_theme']) if data['main_theme']
-        (data['themes'] || {}).each_value { |theme| list << theme_component(theme) }
+        list.concat(theme_components(data))
         (data['plugins'] || {}).each { |slug, plugin| list << plugin_component(slug, plugin) }
         list
       end
 
+      def theme_components(data)
+        themes = [data['main_theme'], *(data['themes'] || {}).values].compact
+        themes.concat(themes.flat_map { |theme| Array(theme['parents']) })
+        themes.map { |theme| theme_component(theme) }.uniq
+      end
+
       def core_component(data)
         {
           kind: 'core',
@@ -285,7 +290,13 @@ module WPScan
       end
 
       def invocation(data)
-        inv = { 'executionSuccessful' => true }
+        failure = data['scan_aborted'] || data['update_aborted']
+        inv = { 'executionSuccessful' => failure.nil? }
+        if failure
+          inv['toolExecutionNotifications'] = [
+            { 'level' => 'error', 'message' => { 'text' => failure.to_s } }
+          ]
+        end
         inv['commandLine'] = "wpscan #{data['command_line']}" if data['command_line']
         inv['hostname'] = data['hostname'] if data['hostname']
         inv['startTimeUtc'] = to_iso8601(data['start_time']) if data['start_time']

data/lib/opt_parse_validator/hacks.rb

@@ -8,12 +8,11 @@ class OptionParser
     class << self
       alias original_candidate candidate
 
-      # rubocop:disable Style/OptionalBooleanParameter
+      # rubocop:disable-next Style/OptionalBooleanParameter
       def candidate(key, icase = false, pat = nil, &)
         # Maybe also do this for -v/--version ?
         key == 'h' ? original_candidate('help', icase, pat, &) : []
       end
-      # rubocop:enable Style/OptionalBooleanParameter
     end
   end
 end

data/lib/opt_parse_validator/opts/positive_integer.rb

@@ -2,6 +2,7 @@
 
 module OptParseValidator
   # Implementation of the Positive Integer Option
+  # attrs[:max], when given, is the highest value accepted
   class OptPositiveInteger < OptInteger
     # @param [ String ] value
     #
@@ -9,6 +10,7 @@ module OptParseValidator
     def validate(value)
       i = super
       raise Error, "#{i} is not > 0" unless i.positive?
+      raise Error, "#{i} is not <= #{attrs[:max]}" if attrs[:max] && i > attrs[:max]
 
       i
     end

data/lib/wpscan/browser/options.rb

@@ -11,6 +11,7 @@ module WPScan
       disable_tls_checks
       headers
       http_auth
+      max_response_size
       max_threads
       proxy
       proxy_auth

data/lib/wpscan/browser.rb

@@ -37,7 +37,12 @@ module WPScan
     #
     # @return [ Typhoeus::Request ]
     def forge_request(url, params = {})
-      Typhoeus::Request.new(url, request_params(params))
+      request = Typhoeus::Request.new(url, request_params(params))
+      # Detection reads the head of a document rather than its tail, so the cap is well above
+      # anything a finder needs. See WPScan::ResponseSizeCap
+      request.max_response_size = max_response_size.to_i * 1024 * 1024
+
+      request
     end
 
     # @return [ Hash ] The request params used to connect to the target as well as other systems (e.g. API).

data/lib/wpscan/cache/file_store.rb

@@ -46,6 +46,14 @@ module WPScan
 
         File.write(entry_path(key), serializer.dump(data_to_store))
         File.write(entry_expiration_path(key), Time.now.to_i + cache_ttl)
+      rescue TypeError => e
+        # Marshal raises TypeError("long too big to dump") for a String of 2GiB or more, which a
+        # target can produce with a single chunked response. Such an entry is not cacheable, but
+        # failing to cache it is not a reason to abort the scan. Any other TypeError (e.g. an
+        # object Marshal cannot dump) is a bug and must surface.
+        raise unless e.message.include?('too big to dump')
+
+        nil
       end
 
       # @param [ String ] key

data/lib/wpscan/controllers.rb

@@ -72,9 +72,8 @@ module WPScan
       end
     ensure
       # The rescue prevents unfinished requests from raising, which would stop reverse_each from running.
-      # rubocop:disable Style/RescueModifier
+      # rubocop:disable-next Style/RescueModifier
       WPScan::Browser.instance.hydra.abort rescue nil
-      # rubocop:enable Style/RescueModifier
 
       # Reverse order: app/controllers/core#after_scan finishes the output and must be last.
       # Guarantees stats are output even on error. after_scan runs only if scan was actually running

data/lib/wpscan/parsed_cli.rb

@@ -25,12 +25,11 @@ module WPScan
     end
 
     # Unknown methods return nil — expected behaviour for option lookups.
-    # rubocop:disable Style/MissingRespondToMissing
+    # rubocop:disable-next Style/MissingRespondToMissing
     def self.method_missing(method_name, *_args, &)
       super if method_name == :new
 
       options[method_name.to_sym]
     end
-    # rubocop:enable Style/MissingRespondToMissing
   end
 end

data/lib/wpscan/public_suffix/domain.rb

@@ -10,7 +10,7 @@ module PublicSuffix
 
     # @return [ Boolean ]
     #
-    # rubocop:disable Naming/PredicateMethod
+    # rubocop:disable-next Naming/PredicateMethod
     def match(pattern)
       pattern = PublicSuffix.parse(pattern) unless pattern.is_a?(PublicSuffix::Domain)
 
@@ -19,7 +19,6 @@ module PublicSuffix
 
       matching_pattern?(pattern)
     end
-    # rubocop:enable Naming/PredicateMethod
 
     protected
 

data/lib/wpscan/target/scope.rb

@@ -46,7 +46,7 @@ module WPScan
     #
     # @return [ Regexp ] The pattern related to the target url and in scope domains,
     #                    it also matches escaped /, such as in JSON JS data: http:\/\/t.com\/
-    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable-next Metrics/AbcSize
     def scope_url_pattern
       return @scope_url_pattern if @scope_url_pattern
 
@@ -64,7 +64,6 @@ module WPScan
 
       @scope_url_pattern = %r{https?:\\?/\\?/(?:#{domains.join('|')})\\?/?}i
     end
-    # rubocop:enable Metrics/AbcSize
 
     # Scope Implementation
     class Scope

data/lib/wpscan/typhoeus/response_size_cap.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module WPScan
+  # Bounds how much of a response is kept in memory, for requests carrying a #max_response_size.
+  #
+  # libcurl's maxfilesize is not enough on its own: it acts on the advertised Content-Length, so it
+  # is a no-op against the chunked responses a dynamic site serves. Only an on_body callback can
+  # stop a transfer by how much has actually arrived.
+  #
+  # The callback is installed on the Ethon easy rather than through Typhoeus::Request#on_body: the
+  # latter puts the request in streaming mode, where Response#body is left empty, and Typhoeus
+  # caches the response before any on_complete could put the body back. Returning :unyielded
+  # tells Ethon to accumulate the chunk as it would with no callback, so the body is intact when
+  # the response is cached, just shorter.
+  module ResponseSizeCap
+    # Adds the per request cap, in bytes. nil or 0 disables it.
+    module Request
+      attr_accessor :max_response_size
+
+      # A capped response may be truncated, so it must not be served from the cache to a request
+      # allowing a larger one. Uncapped requests keep the stock key.
+      def cache_key
+        max_size = max_response_size.to_i
+
+        max_size.zero? ? super : "#{super}-max_response_size:#{max_size}"
+      end
+    end
+
+    # Installs the cap when the easy is built, i.e. after any on_body a caller has added.
+    module EasyFactory
+      def set_callback
+        super
+
+        max_size = request.max_response_size.to_i
+        # A caller doing its own streaming (e.g. Target#log_file?) has its own handling
+        return if max_size.zero? || request.streaming?
+
+        easy.on_body do |_chunk, easy_handle|
+          easy_handle.response_body.bytesize >= max_size ? :abort : :unyielded
+        end
+      end
+    end
+  end
+end
+
+Typhoeus::Request.prepend(WPScan::ResponseSizeCap::Request)
+Typhoeus::EasyFactory.prepend(WPScan::ResponseSizeCap::EasyFactory)

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '4.1.0'
+  VERSION = '4.2.0'
 end

data/lib/wpscan.rb

@@ -27,6 +27,7 @@ require 'xmlrpc/client'
 # Monkey Patches/Fixes
 require 'wpscan/typhoeus/response' # Adds Response#html and from_vuln_api?
 require 'wpscan/typhoeus/hydra'    # https://github.com/typhoeus/typhoeus/issues/439
+require 'wpscan/typhoeus/response_size_cap' # Adds Request#max_response_size
 require 'wpscan/public_suffix/domain' # Adds Domain#match
 require 'wpscan/numeric' # Adds Numeric#bytes_to_human
 # Custom Libs

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 4.1.0
+  version: 4.2.0
 platform: ruby
 authors:
 - WPScanTeam
@@ -323,14 +323,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.82'
+        version: 1.92.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.82'
+        version: 1.92.0
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -351,14 +351,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.3.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: simplecov-lcov
   requirement: !ruby/object:Gem::Requirement
@@ -393,14 +393,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.26.2
+        version: 3.34.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.26.2
+        version: 3.34.0
 description: WPScan is a black box WordPress vulnerability scanner.
 email:
 - contact@wpscan.com
@@ -717,6 +717,7 @@ files:
 - lib/wpscan/target/server/nginx.rb
 - lib/wpscan/typhoeus/hydra.rb
 - lib/wpscan/typhoeus/response.rb
+- lib/wpscan/typhoeus/response_size_cap.rb
 - lib/wpscan/version.rb
 - lib/wpscan/vulnerability.rb
 - lib/wpscan/vulnerability_filter.rb